radius.log into filebeat
What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ? Rgds alex p.s. 3.0.17
On Tue, 2018-04-24 at 17:28 +0100, Alex Sharaz via Freeradius-Users wrote:
What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ?
Haven't looked at filebeat specifically (I've used log-courier in the past) but that should just pick the file up and ship it to logstash I think? Then the logstash filter here should be a good start. https://github.com/FreeRADIUS/freeradius-server/tree/v3.0.x/doc/schemas /logstash -- Matthew
Hi Alex, I have configured radius.log to filebeat and then filebeat ( I use 5.6.5 version ) sends it to logstash for processing. You just need to simply install the filebeat software and then open filebeat.yml: - paths: - /var/log/radius/radius.log document_type: radius_log include_lines: ['Auth'] # this is to only ship log lines that contain the word Auth. You can also ship specific logs similarly by adding the keyword here. Then you need to write the grok filter codes in the logstash to process it and send it to elastic. Regards, BurnZer0 On Tue, Apr 24, 2018 at 9:58 PM, Alex Sharaz via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
What might be the best way to get . the contents of radius.log into filebeat? I'm already generating a suitable detail log file that the filebeat client processes to push radius acct/auth info into our logstash service ?
Rgds alex p.s. 3.0.17 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alex Sharaz -
Burn Zero -
Matthew Newton