ELK监控交换机日志

一、首先部署logstash监控UDP514端口，新建一个配置文件cisco-udp.conf

[root@server-1 conf.d]# cd /etc/logstash/conf.d/
[root@server-1 conf.d]# vim cisco-udp.conf

input{
  udp{
    type => "Cisco-udp"
    port => 514
  }
}
output{
     stdout{
       codec => rubydebug
     }
}

二、加载配置文件

 

来源：https://www.cnblogs.com/sky-cheng/p/11796649.html