Collect logs located in other directories.

[tssingtampa]

Hello community, does the UTMStack agent have the capability to collect custom logs located outside the usual folder directories?

[c3s4rfred]

Hi @tssingtampa, the agent only stores beat related logs, the other inputs act as a proxy, forwarding incoming logs.

If you need to receive custom logs from files, you can modify the UTMStackModulesLogsCollector configuration:

• linux ubuntu bash:

nano /opt/utmstack-linux-agent/beats/filebeat/filebeat.yml

• windows(edit the file):

C:\Program Files\UTMStack\UTMStack Agent\beats\filebeat\filebeat.yml

There you can enable the log collection and configure it to the path you want.

Then you will need to restart the service.

• linux ubuntu bash:

systemctl restart UTMStackModulesLogsCollector

• windows:

sc stop UTMStackModulesLogsCollector&& timeout /t 5 && sc start UTMStackModulesLogsCollector

So you can finally see the logs in the log explorer, under the generic label:

[tssingtampa]

Thank you very much for your prompt response. It was very helpful. The logs are now reaching the server, but I've noticed that they are not being decoded. All the information stays in the message field. I've attached a screenshot for reference.

This is the original logline:

Feb 22 09:11:05 TSS kernel: [10439842.721285] [TS-bridge-inbound-17-D] IN=br0 OUT=br0 PHYSIN=eth1 PHYSOUT=eth0 MAC=70:4a:a5:46:ad:61:11:14:65:c6:0e:f0:08:00 SRC=192.168.1.115 DST=111.230.189.174 LEN=76 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=39694 DPT=123 LEN=56

Is it possible to implement a decoder for this?

[c3s4rfred]

Hi @tssingtampa, custom log parsing must be done by yourself using logstash filters definition language, UTMStack provides a way to add new filters to a specific pipeline, to do that go to Data Processing in the lateral menu , select the pipeline from where the logs are coming, and add you custom filter there. Note that a filter's input structure is the output of the previous one, add filters carefully, sintax error causes the entire pipeline selected to go down.