Before you begin, you’ll need:
- Filebeat 7
- root access
Configure Cisco Meraki logging
Configure your Cisco Meraki server to write all logs to a single file and to send logs to your Filebeat server. Make sure you meet this configuration:
- Log format: syslog
- Send over: UDP
- IP address: Filebeat server IP address
- Port 1514
See Cisco Meraki docs for more information on configuring your Syslog Server.
Download the Logz.io public certificate to your credentials server
For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.
sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt
In the Filebeat configuration file (/etc/filebeat/filebeat.yml) add UDP traffic as an input and Logz.io as an output.
# ... filebeat.inputs: - type: udp max_message_size: 10MiB host: "0.0.0.0:1514" fields: logzio_codec: plain # Your Logz.io account token. You can find your token at # https://app.logz.io/#/dashboard/settings/manage-accounts token: <<LOG-SHIPPING-TOKEN>> type: cisco-meraki fields_under_root: true encoding: utf-8 ignore_older: 3h # ... For Filebeat 7 only ... filebeat.registry.path: /var/lib/filebeat processors: - rename: fields: - from: "agent" to: "filebeat_agent" ignore_missing: true - rename: fields: - from: "log.file.path" to: "source" ignore_missing: true # ... output.logstash: hosts: ["<<LISTENER-HOST>>:5015"] ssl: certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
Replace the placeholders to match your specifics. (They are indicated by the double angle brackets
<<LOG-SHIPPING-TOKEN>>with the token of the account you want to ship to.
<<LISTENER-HOST>>with the host for your region. For example,
listener.logz.ioif your account is hosted on AWS US East, or
listener-nl.logz.ioif hosted on Azure West Europe.
One last validation - make sure Logz.io is the only output and appears only once. If the file has other outputs, remove them.
Start or restart Filebeat for the changes to take effect.
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.
If you still don’t see your logs, see log shipping troubleshooting.