Start your 14-day free trial today

No Credit Card Required

Try Logit.io Free

Already have an account? Sign In

Send data via Axonius to your Logstash instance provided by Logit.io

Axonius

Ship axonius logs to logstash

Step 1 - Setup Syslog OutputCopy

On your Axonius web interface, go to System Settings > Global Settings > Syslog Settings.

Select Use Syslog.

Enter the IP address of your remote syslog server into the Syslog host field. This is your Filebeat Server.

Enter the port number.

Select UDP in the Protocol menu.

Step 2 - Install FilebeatCopy

deb (Debian/Ubuntu/Mint)

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-amd64.deb
sudo dpkg -i -oss-7.15.1-amd64.deb

rpm (CentOS/RHEL/Fedora)

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-x86_64.rpm
sudo rpm -vi -oss-7.15.1-x86_64.rpm

macOS

curl -L -O https://artifacts.elastic.co/downloads/beats//-oss-7.15.1-darwin-x86_64.tar.gz
tar xzvf -oss-7.15.1-darwin-x86_64.tar.gz

Windows

  • Download and extract the Windows zip file.
  • Rename the -<version>-windows directory to ``.
  • Open a PowerShell prompt as an Administrator.
  • Run the following to install as a Windows service:
.\install-service-.ps1
If script execution is disabled on your system, you need to set the execution policy for the current session to allow the script to run. For example: PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-.ps1.
My OS isn't here! Chat to support now

Step 3 - Configure FilebeatCopy

Copy and use the Filebeat configuration below.

For use with version 7.x Filebeats.
# ============================== Filebeat inputs ==============================
filebeat.inputs:

- type: udp
  max_message_size: 10MiB
  host: "<INSERT-FILEBEAT-SERVER-IP>:514"
  fields:
    type: axonius
   
  fields_under_root: true
  encoding: utf-8
  ignore_older: 3h
 
filebeat.registry.path: /var/lib/filebeat

# ================================== Outputs ===================================
<div class="sw-warning">
    <b>No input available! </b> Your stack is missing the required input for this data source <a href="#" onclick="Intercom('showNewMessage')" class="btn btn-info btn-sm">Talk to support to add the input</a>
</div> 

Step 4 - Start FilebeatCopy

Ok, time to start ingesting data!

deb/rpm

sudo systemctl enable filebeat
sudo systemctl start filebeat

macOS

./filebeat

Windows

PS C:\Program Files\Filebeat> Start-Service filebeat

Step 5 - how to diagnose no data in StackCopy

If you don't see data appearing in your Stack after following the steps, visit the Help Centre guide for steps to diagnose no data appearing in your Stack or Chat to support now.

Toggle View

Expand View

Return to Search

© 2022 Logit.io Ltd, All rights reserved.