<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Some thoughts on my deployment</div><div class=""><br class=""></div><div class=""><b class="">Logstash</b></div><div class="">I think I’m going to need to re-introduce logstash just to leverage the existing open source material of logstash filters and Kibana desktops. </div><div class="">VMware, ASA for example but wanted more real time data. I could probably do the realtime tags with pattendb. </div><div class=""> </div><div class=""><b class="">syslog-ng counters</b> </div><div class="">We use an IPAM API to create unique filters, log and destination conf files. The goal was to get unique syslog counters for every VLAN realtime directly from syslog-ng-ctl stats.. </div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">@include IPAM-filters</div><div class=""><div class="">filter f_192_168_252_0 { netmask(192.168.252.0/24);};</div><div class="">filter f_192_168_253_0 { netmask(192.168.253.0/24);};</div><div class="">filter f_192_168_254_0 { netmask(192.168.254.0/30);};</div></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">@include IPAM-dest.conf</div><div class=""><div class="">destination d_192_168_252_0 { file(/opt/syslog-ng/logs/192_168_252_0/$YEAR$MONTH$DAY-$HOUR-$HOST.log);};</div><div class="">destination d_192_168_253_0 { file(/opt/syslog-ng/logs/192_168_253_0/$YEAR$MONTH$DAY-$HOUR-$HOST.log);};</div><div class="">destination d_192_168_254_0 { file(/opt/syslog-ng/logs/192_168_254_0/$YEAR$MONTH$DAY-$HOUR-$HOST.log);};</div></div><div class=""><br class=""></div><div class="">@include IPAM-log.conf</div><div class=""><div class="">log { source(s_net); filter(f_192_168_252_0); destination(d_192_168_252_0);};</div><div class="">log { source(s_net); filter(f_192_168_253_0); destination(d_192_168_253_0);};</div><div class="">log { source(s_net); filter(f_192_168_254_0); destination(d_192_168_254_0);};</div><div class="">log { source(s_net); filter(f_192_168_254_4); destination(d_192_168_254_4);};</div></div><div class=""><br class=""></div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 20, 2016, at 11:18 AM, Scot Needy <<a href="mailto:scotrn@gmail.com" class="">scotrn@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br class=""><br class="">Hi, <br class=""><br class=""> Does anyone have links or care to share notes on making a syslog-ng -> ELK scale for enterprise ? <br class=""><br class="">I have some ideas and will gladly share my solution but also don’t want to spend days figuring these things out that have already been built. <br class="">There are many ELK specific references but I also want to make sure the model fits the syslog workload. <br class=""><br class=""><br class="">Thanks <br class=""><br class=""></div></blockquote></div><br class=""></body></html>