# Syslogging Struggle - newbie alert **URL:** \ **Category:** Elasticsearch\ **Created:** [November 22, 2021, 5:51pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861 "2021-11-22T17:51:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Orpheus](https://avatars.discourse-cdn.com/v4/letter/o/e36b37/32.png) [@Orpheus](https://discuss.elastic.co/u/Orpheus)\ **Post date:** [November 22, 2021, 5:51pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861/1 "2021-11-22T17:51:19Z")
Hi, I'm just getting familiar with Elastic Stack, and implementing ELK with Filebeat to a syslog server that receives the syslogs from various routers on a network. The routers are running RouterOS on mikrotik routers, which I believe is set-up properly to send the data. Then Filebeat is configured to receive on the same port via the syslog config settings. This appears to be functioning, as netstat shows the ports to be listening/available. The next step I am a bit lost for is what I need to do so the rest of the stack communicates and parses/visualizes the data. Logstash is set up simply to listen to Filebeat and output to Elasticsearch/kibana I cannot find any Elasticsearch modules that deal with general syslogs other than for the host server logs (System module), and all other modules appear to deal with proprietary equipment. Do I need to create ingest pipelines specifically to read the data from Mikrotik/RouterOS? Even though they supposedly ship data in BSD format? If so, which program should I do this in? Filebeat? Logstash? or Elasticsearch/kibana? And afterwards, I assume I will have to create a custom dashboard, but I think I can figure that out as long as I can find where the data is from the routers. What am I missing in order to begin seeing stats from these routers? Thank you in advance! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 22, 2021, 10:50pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861/2 "2021-11-22T22:50:12Z")
Welcome to our community! 😃 It sounds like you want to use Logstash to process the logs using grok, to structure them, and then push them to Elasticsearch. Or use an ingest pipeline in Elasticsearch to do it. As there is no Filebeat module to do this for you as you mention. (There is existing Logstash [grok patterns](https://github.com/frap/logstash/blob/master/patterns/mikrotik) for mikrotik, but they aren't in Elasticsearch for some reason!) And yes, you will need a custom dashboard due to the lack of a module. ---
**Author:** ![Orpheus](https://avatars.discourse-cdn.com/v4/letter/o/e36b37/32.png) [@Orpheus](https://discuss.elastic.co/u/Orpheus)\ **Post date:** [November 23, 2021, 2:01pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861/3 "2021-11-23T14:01:36Z")
Cool, thank you for the reply! I head in this direction, much appreciated! ---
**Author:** ![Micah\_Barsness](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/micah_barsness/32/83318_2.png) [@Micah\_Barsness](https://discuss.elastic.co/u/Micah_Barsness)\ **Post date:** [November 23, 2021, 2:03pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861/4 "2021-11-23T14:03:53Z")
Do you have a .conf file started for Logstash? ---
**Author:** ![Orpheus](https://avatars.discourse-cdn.com/v4/letter/o/e36b37/32.png) [@Orpheus](https://discuss.elastic.co/u/Orpheus)\ **Post date:** [November 23, 2021, 2:07pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861/5 "2021-11-23T14:07:45Z")
I have a beats input .conf and an Elasticsearch output .conf I already have the server data "system module" feeding into Elasticsearch, as well as the netflow module via one of the mikrotik routers. This syslog from the routers is the last piece of this puzzle. Will I need a third .conf? or would I manipulate the one that is coming from filebeat? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 21, 2021, 2:08pm UTC](https://discuss.elastic.co/t/syslogging-struggle-newbie-alert/289861/6 "2021-12-21T14:08:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.