Configuration
Before you begin, you’ll need:
- Filebeat 7
- root access
Configure Cisco Meraki logging
Configure your Cisco Meraki server to write all logs to a single file and to send logs to your Filebeat server. Make sure you meet this configuration:
- Log format: syslog
- Send over: UDP
- IP address: Filebeat server IP address
- Port 1514
See Cisco Meraki docs for more information on configuring your Syslog Server.
Download the Logz.io public certificate to your Filebeat server
For HTTPS shipping, download the Logz.io public certificate to your certificate authority folder.
sudo curl https://raw.githubusercontent.com/logzio/public-certificates/master/AAACertificateServices.crt --create-dirs -o /etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt
Configure Filebeat
In the Filebeat configuration file (/etc/filebeat/filebeat.yml) add UDP traffic as an input and Logz.io as an output.
# ...
filebeat.inputs:
- type: udp
max_message_size: 10MiB
host: "0.0.0.0:1514"
fields:
logzio_codec: plain
# Your Logz.io account token. You can find your token at
# https://app.logz.io/#/dashboard/settings/manage-accounts
token: <<LOG-SHIPPING-TOKEN>>
type: cisco-meraki
fields_under_root: true
encoding: utf-8
ignore_older: 3h
# ... For Filebeat 7 only ...
filebeat.registry.path: /var/lib/filebeat
processors:
- rename:
fields:
- from: "agent"
to: "filebeat_agent"
ignore_missing: true
- rename:
fields:
- from: "log.file.path"
to: "source"
ignore_missing: true
# ...
output.logstash:
hosts: ["<<LISTENER-HOST>>:5015"]
ssl:
certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']
Replace the placeholders in your Filebeat configuration
Still in the same configuration file, replace the placeholders to match your specifics.
-
Replace
<<LOG-SHIPPING-TOKEN>>
with the token of the account you want to ship to. -
Replace
<<LISTENER-HOST>>
with your region’s listener host (for example,listener.logz.io
). For more information on finding your account’s region, see Account region.
One last validation - make sure Logz.io is the only output and appears only once. If the file has other outputs, remove them.
Start Filebeat
Start or restart Filebeat for the changes to take effect.
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.
If you still don’t see your logs, see log shipping troubleshooting.