Process log entries in ELK stack

1

Hi all
I’m trying to read/process log entries from my Cisco asa 5505 on my ELK 6 stack. I’ve tried several guides on the internet but haven’t found anything I could use.
Does someone out there have a working solution on this? I really need some help here.

Best regards

2

Hi Søren,

I think the easiest method is to run logstash on a machine that captures your syslog messages, then process those and send them to ELK.

I did see some good examples for this, logstash can be a pain to setup (and troubleshoot) though:

https://jackhanington.com/blog/2014/04/21/using-logstash-elasticsearch-and-kibana-for-cisco-asa-syslog-message-analysis/

Where do you run ELK on? self-hosted?

Rene