Hey all, got a quick question!

I want to receive, parse and store syslogs from various devices on my home network on my windows box. I know, I know, its a bit backwards but I'd like to proceed with this sort of setup if possible (not against discussion, of course).

I've looked and looked for options but it seems like everything has been bare bones and basically just receives, or is locked behind premium. Surely there's some sort of solution out there, no? I'd be willing to implement something in Python if I need to but I'm considerably more hesitant when compared to using an open source soln.

Thanks for your time, looking forward to discussing/learning more!

  • alex_02@infosec.pub
    ·
    edit-2
    10 months ago

    For the elk stack you can replace Logstash and Filebeat with Fluentbit and feed it directly to Elastic Search than use Kibana. I've found Logstash to be the resource hog and Fluentbit just runs a lot better imo.

    Some docs:

    https://docs.fluentbit.io/manual/pipeline/inputs/syslog

    https://docs.fluentbit.io/manual/pipeline/outputs/elasticsearch

    EDIT: All three of them can also be run in a docker or several depending on your needs and how you configure.