Log Server Configuration¶
URL: /admin/settings/log-servers
The Log Server Configuration page manages push-based log ingestion listeners for the Signal Server service. Each listener accepts incoming log data on a specific protocol and port.
Log Server Connectors¶
| Connector | Port | Protocol | Description |
|---|---|---|---|
| Syslog UDP | 514 | UDP | Standard syslog over UDP. Lightweight, no delivery guarantee. |
| Syslog TCP | 514 | TCP | Standard syslog over TCP. Reliable delivery with connection tracking. |
| Secure Syslog TLS | 6514 | TCP or TLS | Syslog over TLS when TLS is enabled on the Conductor node (the configuration wizard's default); plain TCP otherwise. Required for compliance environments. |
| Syslog RFC6587 | 7514 | TCP or TLS | Syslog with RFC 6587 octet counting: each message is sent as its length in bytes, a space, then the message, with nothing between messages. Uses TLS when TLS is enabled on the node, as 6514 does. |
| Beats/Logstash | 5044–5045 | TCP or TLS | Elastic Beats and Logstash Lumberjack protocol for agent-based collection. Port 5044 uses TLS when TLS is enabled on the Conductor node; port 5045 never uses TLS. |
Features¶
Enable/Disable Toggles¶
Each log server connector has an independent toggle. Disabled connectors stop listening on their respective ports.
Masquerading Options¶
Log server connectors support protocol masquerading, which allows a listener to accept data in one format and tag it as another protocol type. This is useful when:
- Network devices send non-standard syslog formats
- Protocol conversion is needed at the ingestion point
- Legacy devices use unexpected port/protocol combinations
Configuration¶
Changes are saved to the NATS KV SERVERS bucket and propagate to the Signal Server service within seconds. No container restart is required.
Tip
For most deployments, enable Syslog UDP (port 514) for general syslog collection and Secure Syslog TLS (port 6514) for devices that support encrypted transport. Port 6514 uses TLS when TLS is enabled on the Conductor node (the configuration wizard's default); plain TCP otherwise. Use Beats/Logstash (ports 5044–5045) for environments with Elastic Beats agents deployed on endpoints.
Sending from Elastic Beats¶
To stream data from the OSS editions of Filebeat, Winlogbeat, or Packetbeat into the Beats/Logstash listener, see the Log Shippers (Beats) guides. They cover installing the OSS (Apache 2.0) builds and the example output.logstash configuration for each agent.