Skip to main content


Crowdstrike is a SaaS (software as a service) system security solution. Deploy this integration to ship Crowdstrike events from your Crowdstrike account to using FluentD.


Fluentd will fetch all existing logs, as it is not able to ignore older logs.

This integration includes:

  • Establishing communication between the Crowdstrike connector and your Crowdstrike account
  • Configuring a FluentD agent on your device
  • Establishing communication between the FluentD agent and your account

Crowdstrike integration architecture

Upon deployment, the Crowdstrike connector connects to your Crowdstrike account to collect events. This data is written into a file on your device. The FluentD agent collects the data from this file, connects to your account and sends the events to

Before you begin, you'll need:

  • an active account with Crowdstrike
  • an active account with
  • FluentD agent on your machine
  • Crowdstrike connector installed on your machine

Configure Crowdstrike connector

  1. Open the configuration file located at /opt/crowdstrike/etc/cs.falconhoseclient.cfg.
  2. Enter the Client ID value into the client_id value field.
  3. Enter the Client Secret value into the client_secret value field.
  4. Make sure that the base URL in api_url and request_token_url corresponds to the base URL for your account.
  5. Save the changes.

Install Ruby gems for FluentD

  1. Install the fluent-plugin-concat gem. This gem concatenates multiline logs.
  2. Install the fluent-plugin-logzio gem. This gem enables communication between your FluentD agent and

Configure FluentD

  1. Write down your listener URL and logs shipping token by navigating to your account and selecting Settings > Tools > Manage Tokens. The Listener URL for your account is displayed above the token table.
  2. Create a new configuration file for your FluentD. For example, fluentdconfig.conf.
  3. Copy and paste the code block below into the configuration file. The log_level setting defines which events are recorded in the log. In order of verbosity, the log level can be defined as fatal, error, warn, info, debug or trace. The default for the log level is info: The info level records all events categorized as info and higher in verbosity. To learn more about the settings used in the configuration file, see plugin for Fluentd.
log_level info

# Tailing the default path Crowdstrike's SIEM Connector
@type tail
path /var/log/crowdstrike/falconhoseclient/output
pos_file /var/log/td-agent/falconhoseclient.log.pos
tag crowdstrike-fluentd
@type none

# Concatenating the event as one log
<filter crowdstrike-fluentd>
@type concat
key message
multiline_start_regexp /^{/
multiline_end_regexp /^}/

# This adds type to the log && removes key log & message. If you change the type in this code section, the data is not parsed into the relevant fields for the Crowdstrike integration.
<filter crowdstrike-fluentd>
@type record_transformer
type crowdstrike

# Sending to
<match crowdstrike-fluentd>
@type logzio_buffered

endpoint_url https://<<LISTENER-HOST>>:8071?token=<<LOG-SHIPPING-TOKEN>>

output_include_time true
output_include_tags true
http_idle_timeout 10

@type memory
flush_thread_count 4
flush_interval 3s
chunk_limit_size 16m # bulk limit is decoupled from chunk_limit_size. Set whatever you want.
queue_limit_length 4096

# Exclude fluentd logs
<label @FLUENT_LOG>
<match **>
@type null

If you change type in the @type record_transformer section, the data is not parsed into the relevant fields for the Crowdstrike integration.

Replace <<LISTENER-HOST>> with the host for your region. For example, if your account is hosted on AWS US East, or if hosted on Azure West Europe. The required port depends whether HTTP or HTTPS is used: HTTP = 8070, HTTPS = 8071. Replace <<LOG-SHIPPING-TOKEN>> with the token of the account you want to ship to.

  1. Save the changes.

Start the Crowdstrike connector

Run the following command:

  • For Ubuntu 14.x:
sudo start cs.falconhoseclientd
  • For Ubuntu 16.04 and later:
sudo systemctl start cs.falconhoseclientd.service
  • For CentOS:
sudo service cs.falconhoseclientd start

Start FluentD

Start your FluentD agent with the configuration file created for this integration.

For example, run fluentd -c <<PATH-TO-YOUR-FLUENTD-CONFIG-FILE>>.

Check for your events

Give your events some time to get from your system to ours, and then open Open Search Dashboards. You can filter for data of type crowdstrike to see the incoming Crowdstrike events.

If you still don't see your logs, see Filebeat troubleshooting.