Using Cisco Fleet Integration

Elastic Stack Beats
1

Hi Elastic Users and Team.

I managed to install the fleet-server on prem and added the Cisco Fleet Integration to the fleet-server itself.

ELK Stack and also the fleetserver is on one virtual machine.

So my thought was now to tell our networking team to send the Cisco IOS Logs to the FQDN of that ELK Stack Server on Port 9002.

Am I correct with this?
What I am missing?

It seems that there are no logs shipped from that test Cisco Switch into Elasticsearch.

On the Configuration of the Cisco module I have just changed from localhost to the FQDN.
Left the ports as is.
Is there another config to do?
Or where I can check that logs actually?

Thank you for any answers.
Regards
Peter

2

Well I found it... the port 9002/UDP wasn't open.
Opened it and now in the DataStreams I can see cisco.ios.

But there is no dashboard to see those informations.
And if I search within metrics or logs for the trap informations sent by the cisco switch it does not find anything out of it...

Where is this data now?

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.