Skip to main content

Cisco Meraki

Cisco Meraki is a centralized management service that allows users to manage all of their Meraki network devices via a single simple and secure platform.

Before you begin, you'll need:

Configure Cisco Meraki logging

Configure your Cisco Meraki server to write all logs to a single file and to send logs to your Filebeat server. Make sure you meet this configuration:

  • Log format: syslog
  • Send over: UDP
  • IP address: Filebeat server IP address
  • Port 1514

See Cisco Meraki docs for more information on configuring your Syslog Server.

Download the Logz.io public certificate

For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.

sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt

Configure Filebeat

In the Filebeat configuration file (/etc/filebeat/filebeat.yml) add UDP traffic as an input and Logz.io as an output.

note

Filebeat requires a file extension specified for the log input.

# ...
filebeat.inputs:
- type: udp
max_message_size: 10MiB
host: "0.0.0.0:1514"

fields:
logzio_codec: plain

# Your Logz.io account token. You can find your token at
# https://app.logz.io/#/dashboard/settings/manage-accounts
token: <<LOG-SHIPPING-TOKEN>>
type: cisco-meraki
fields_under_root: true
encoding: utf-8
ignore_older: 3h

# ... For Filebeat 7 only ...
filebeat.registry.path: /var/lib/filebeat
processors:
- rename:
fields:
- from: "agent"
to: "filebeat_agent"
ignore_missing: true
- rename:
fields:
- from: "log.file.path"
to: "source"
ignore_missing: true

# ...
output.logstash:
hosts: ["<<LISTENER-HOST>>:5015"]
ssl:
certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']

Replace the placeholders to match your specifics. (They are indicated by the double angle brackets << >>):

  • Replace <<LOG-SHIPPING-TOKEN>> with the token of the account you want to ship to.

  • Replace <<LISTENER-HOST>> with the host for your region.

note

One last validation - make sure Logz.io is the only output and appears only once. If the file has other outputs, remove them.

Start Filebeat

Start or restart Filebeat for the changes to take effect.

Check Logz.io for your logs

Give your logs some time to get from your system to ours, and then open Open Search Dashboards.

If you still don't see your logs, see Filebeat troubleshooting.