Ship logs from network devices

Setup

Guided configuration

You’ll need: Filebeat 7 or Filebeat 6, root access

1. Configure your device

   Configure your network device to send logs to your Filebeat server, TCP port 9000. See your device’s documentation if you’re not sure how to do this.

2. Download the Logz.io certificate to your Filebeat server

   For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.

   sudo wget https://raw.githubusercontent.com/logzio/public-certificates/master/COMODORSADomainValidationSecureServerCA.crt -P /etc/pki/tls/certs/
   

3. Add TCP traffic as an input

   In the Filebeat configuration file (/etc/filebeat/filebeat.yml), add TCP to the filebeat.inputs section.

   Replace <<SHIPPING-TOKEN>> with the token of the account you want to ship to.

   • Filebeat 7
   • Filebeat 6

   # Filebeat 7 configuration
   
   filebeat.inputs:
   - type: tcp
     max_message_size: 10MiB
     host: "0.0.0.0:9000"
   
     fields:
       logzio_codec: plain
   
       # Your Logz.io account token. You can find your token at
       #  https://app.logz.io/#/dashboard/settings/manage-accounts
       token: <<SHIPPING-TOKEN>>
       type: network-device
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
   
   filebeat.registry.path: /var/lib/filebeat
   processors:
   - rename:
       fields:
       - from: "agent"
         to: "filebeat_agent"
       ignore_missing: true
   - rename:
       fields:
       - from: "log.file.path"
         to: "source"
       ignore_missing: true
   

   # Filebeat 6 configuration
   
   filebeat.inputs:
   - type: tcp
     max_message_size: 10MiB
     host: "0.0.0.0:9000"
   
     fields:
       logzio_codec: plain
   
       # Your Logz.io account token. You can find your token at
       #  https://app.logz.io/#/dashboard/settings/manage-accounts
       token: <<SHIPPING-TOKEN>>
       type: network-device
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
   
   filebeat.registry_file: /var/lib/filebeat/registry
   

4. Add Logz.io as an output

   If Logz.io is not an output, add it now.

   Replace <<LISTENER-HOST>> with your region’s listener host (for example, listener.logz.io). For more information on finding your account’s region, see Account region.

   output.logstash:
     hosts: ["<<LISTENER-HOST>>:5015"]
     ssl:
       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
   

5. Start Filebeat

   Start or restart Filebeat for the changes to take effect.

6. Check Logz.io for your logs

   Give your logs some time to get from your system to ours, and then open Kibana.

   If you still don’t see your logs, see log shipping troubleshooting.