Syslog with Elasticsearch

Syslog with Elasticsearch

Configuration Guide	md-a5kj5
Date	February 13, 2026
RouterOS Version	7.x
Elasticsearch Version	8.x

---

Overview

Elasticsearch is a powerful NoSQL database that can store and analyze log data from RouterOS devices. Combined with Kibana, it provides a comprehensive solution for centralized logging, searching, and visualization of MikroTik router logs.

This guide covers setting up syslog collection from RouterOS devices to Elasticsearch using the syslog protocol (RFC 5424).

---

Prerequisites

• RouterOS v7.x device
• Elasticsearch 8.x installed (single node or cluster)
• Kibana 8.x for visualization
• Network connectivity between RouterOS and Elasticsearch on syslog port (UDP/TCP 514)

---

Setup

Elastic Configuration

1. Configure Syslog Input

In Elasticsearch 8.x, you need to enable the syslog input in elasticsearch.yml:

/etc/elasticsearch/elasticsearch.yml

xpack.security.enabled: true
xpack.security.authc.api_key.enabled: true

# Syslog input (UDP)
ingest.geoip.downloader.enabled: false

2. Install Syslog Pipeline

Create an ingest pipeline for syslog parsing:

# Create syslog ingest pipeline
PUT _ingest/pipeline/syslog
{
  "description": "Parse RouterOS syslog messages",
  "processors": [
    {
      "grok": {
        "field": "message",
        "patterns": [
          "%{SYSLOGTIMESTAMP:timestamp} %{HOSTNAME:host} %{DATA:program}: %{GREEDYDATA:message}"
        ]
      }
    },
    {
      "date": {
        "field": "timestamp",
        "formats": ["MMM dd HH:mm:ss"]
      }
    }
  ]
}

3. Create Index Template

# Create index template for RouterOS logs
PUT _index_template/routeros-syslog
{
  "index_patterns": ["routeros-logs-*"],
  "template": {
    "mappings": {
      "properties": {
        "timestamp": {"type": "date"},
        "host": {"type": "keyword"},
        "program": {"type": "keyword"},
        "message": {"type": "text"},
        "topic": {"type": "keyword"},
        "router": {"type": "keyword"}
      }
    }
  }
}

4. Configure Filebeat (Recommended Alternative)

Instead of direct syslog ingestion, use Filebeat:

/etc/filebeat/filebeat.yml

filebeat.inputs:
- type: syslog
  protocol.udp:
    host: "0.0.0.0:514"
  protocol.tcp:
    host: "0.0.0.0:514"

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "routeros-logs-%{[agent.version]}"

Enable the syslog module:

filebeat modules enable syslog

RouterOS Configuration

1. Create Syslog Action

# Create syslog action pointing to Elasticsearch server
/system logging action
add name="elastic" remote=10.0.0.100 remote-port=514 \
    syslog-facility=local0 syslog-severity=informative \
    target=remote

2. Configure Logging Topics

# Add logging rules for topics you want to send to Elasticsearch
/system logging
add action=elastic topics=info
add action=elastic topics=warning
add action=elastic topics=error
add action=elastic topics=critical
add action=elastic topics=system
add action=elastic topics=firewall
add action=elastic topics=accounting

3. Verify Configuration

# Check logging configuration
/system logging print

# Test syslog UDP port connectivity
/ping 10.0.0.100 protocol=udp port=514 count=3

---

Using Kibana

1. Access Kibana

Open Kibana in your browser and navigate to Discover or create a new index pattern.

2. Create Index Pattern

1. Go to Stack Management → Index Patterns
2. Create index pattern: routeros-logs-*
3. Set @timestamp or timestamp as the time field

3. Create Visualizations

Search for Specific Topics

program:firewall AND message:drop
program:dhcp
topic:error

Common Dashboard Panels

Panel Type	Description	Query
Firewall Drops	Show dropped packets	program:firewall AND message:drop
Error Count	Track errors over time	topic:error
System Events	Router system messages	topic:system
Bandwidth Alerts	Traffic threshold warnings	program:traffic

---

Troubleshooting

Check Elasticsearch Received Logs

# Verify logs are being received
curl -XGET 'localhost:9200/routeros-logs-*/_search?pretty&q=*'

# Check index exists
curl -XGET 'localhost:9200/_cat/indices/routeros-logs-*'

RouterOS Debugging

# Check if syslog is being sent
/system logging print

# View local logs
/log print

# Enable debug logging temporarily
/system logging add topics=debug action=elastic

Common Issues

Issue	Solution
No logs in Elasticsearch	Check firewall allows UDP/TCP 514
Index not created	Verify Filebeat/ingest pipeline is running
Missing timestamps	Check date processor in ingest pipeline
High memory usage	Reduce number of logging topics or use filtering

Network Verification

# Test syslog TCP port connectivity
/tool telnet 10.0.0.100 514

# Capture packets to verify sending
/tool sniffer start interface=ether1 port=514
/tool/sniffer/packet/print

---

Security Considerations

1. Enable TLS - Use syslog over TLS (RFC 5425) for encrypted transmission
2. Firewall Rules - Restrict syslog port to only your Elasticsearch server
3. Authentication - Consider using API keys for Filebeat authentication
4. Rate Limiting - Configure appropriate logging levels to avoid log flooding

---

Related Topics

• Logging Configuration Brief
• NetFlow analysis with Elasticsearch
• CEF with Elasticsearch