- Getting started
- Architecture
- Administration
- User interface
-
System configuration
- Installation of software packages
-
Relays
- The In-house Relay
- In-house Relay rules
- In-house Relay configuration
- In-house Relay installation using a virtual machine
- In-house Relay installation using the software package
- Installing the USA relay on an Ubuntu 16 VM server
- CentOS relay installation
- Relay installation in any Linux distribution
- High-availability relay
- In-house Relay troubleshooting
- Sending the data
- Supported technologies
-
Data Search
- Running a search
- LINQ
- Viewing the data tables
- Viewing column info
- Running queries (tutorials)
- Last queries
- Query management
- Lookup management
- Favorite queries
- Sharing queries
- Table toolbar features
-
Additional tools
- Dashboard data source
-
Charts
- Affinity chord diagram
- Availability timeline
- Bipartite chord diagram
- Bubble chart
- Chart aggregation
- Custom date chart aggregation
- Flame graph
- Flat world map by coordinates
- Flat world map by country
- Google animated heat map
- Google area map
- Google heat map
- Graph diagram
- Histogram
- Pie chart
- Pie layered chart
- Punch card
- Sankey diagram
- Scatter plot
- Time heatmap
- Voronoi treemap
- Graphical correlation
- Query Info
- Custom tables
- Aliased finder
- Custom finder
- Data reinjection
- Available operations
- Best practices for data search
- Alerts management
-
Dashboards
- Setup a data source
- Create a new dashboard
-
Working with dashboard widgets
- Availability timeline widget
- Chord diagram widget
- Circle world map widget
- Color key value widget
- Color world map widget
- Column chart widget
- Comparative chart widget
- Funnel widget
- Gauge meter widget
- Google heatmap widget
- Heat calendar widget
- Line chart widget
- Monitoring widget
- Pie chart widget
- Punch card widget
- Sectored pie chart widget
- Table widget
- Time heatmap widget
- Tree diagram widget
- Voronoi tree widget
- Configuring and sharing dashboards
- API
- Use cases
System configuration / Sending the data / Sending the data using Logstash / Sending from an In-house Relay
Download as PDFSending from an In-house Relay
This is the preferred sending option since it doesn't require the specification of authentication certificates in the Logstash configuration file.
When sending data through a relay, Logstash must be installed in the same machine as the relay.
The example below highlights the output section of the configuration file and shows that the events are sent to port 13000 on localhost. Port 13000 is used since we specify the tag in the appname variable.
input {...}
output {
syslog {
facility => "local7"
severity => "informational"
host => "localhost"
port => 13000 ### send to port 13000 so the relay resend it to Devo
sourcehost => "syslogHostname" ### syslog message hostname
appname => "av.mcafee.epo.events" ### syslog message tag
protocol => "tcp"
}
}