How to get logs from Mikrotik to Logstash?

Question

Mikrotik

Please share the working config for receiving logs in logstash (with sending to elasticsearch).

Answer 1

#tcp syslog stream via 5140
input {
tcp {
type => "syslog"
port => 5140
}
}
#udp syslogs tream via 5140
input {
udp {
type => "syslog"
port => 5140
}
}
filter {
if [type] == "syslog" {
grok {
match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\]) ?: %{GREEDY$
add_field => [ "received_at", "%{@timestamp}" ]
add_field =>[ "received_from", "%{host}" ]
}
syslog_pri { }
date {
match => [ "syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss" ]
}
}
}
output {
elasticsearch { host => localhost }
stdout { codec = > rubydebug }
}

Answer 2

The steps for collecting Mikrotik logs in the elk stack are described in detail here - https://serveradmin.ru/tsentralizovannyiy-sbor-log...
I understand that this has not been relevant for a long time, but this is for those who come here from the search. In Google in the issuance of this question at the top.