OpenVPN is a virtual private network system for secure point-to-point or site-to-site connections.

These instructions only apply to Linux and MacOS systems.

Before you begin, you’ll need:

  • An active account with
  • OpenVPN Access Server installed
  • Filebeat installed on the same machine as OpenVPN Access Server
  • Root priveleges on your machines
Download the public certificate to your credentials server

For HTTPS shipping, download the public certificate to your certificate authority folder.

sudo curl --create-dirs -o /etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt
Configure Filebeat

Paste the following into the inputs section of the Filebeat configuration file:

   - type: log
       - /var/log/openvpnas.log
       - /var/log/openvpnas.log.*
       logzio_codec: json
       # Your account token. You can find your token at
       token: <<LOG-SHIPPING-TOKEN>>
       type: openvpn
     fields_under_root: true
     encoding: utf-8
     ignore_older: 3h
     multiline.type: pattern
     multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\+[0-9]{4} \[\S+\]( {2,}| \})'
     multiline.negate: false
     multiline.match: after
   filebeat.registry.path: /var/lib/filebeat
   - rename:
       - from: "agent"
         to: "beat_agent"
       ignore_missing: true
   - rename:
       - from: "log.file.path"
         to: "source"
       ignore_missing: true
     hosts: ["<<LISTENER-HOST>>:5015"]
       certificate_authorities: ['/etc/pki/tls/certs/COMODORSADomainValidationSecureServerCA.crt']

If you’re running Filebeat 8.1+, the type of the filebeat.inputs is filestream instead of logs:

   - type: filestream
       - /var/log/*.log
Restart Filebeat to run it with the new configuration.
service filebeat restart
Check for your logs

Give your logs some time to get from your system to ours, and then open Kibana. You can filter for data of type openvpn to see the incoming OpenVPN logs.

If you still don’t see your data, see log shipping troubleshooting.