Edge Delta Ports Input

Overview

This input type allows you to specify a set of ports and protocols that the agent will listen for.

Ports are typically used to listen to incoming traffic from:

• Network devices (firewalls, switches, routers)
• Time-series metrics (statsd, graphite, carbon)
• Centralized logging architectures (rsyslog, syslog-ng)

Example

  ports:
    - protocol: tcp
      port: 514
      labels: "syslog,firewall"
      line_pattern: '^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}'
    - protocol: tcp
      port: 24680
      labels: "errorcheck"
    - protocol: udp
      port: 13579
      labels: "errorcheck"
    - protocol: tcp
      port: 8080
      labels: "syslog,tls,service_a"
      tls:
        crt_file: /certs/server-cert.pem
        key_file: /certs/server-key.pem
        ca_file: /certs/ca.pem

Parameters

labels

Required

Enter a descriptive label for this input.

When you create a workflow, you will use this label to enter your input into the workflow.

errorcheck is the default label.

labels: "syslog,firewall"

protocol

Required

Enter tcp or udp.

protocol: tcp

port

Required

Enter the port that the agent should listen for.

port: 514

filters

Optional

Select an existing filter to add to this input.

To learn how to create a filter, see Filters.

filters: 
  - enrichment-failure-behavior

line_patterns

Optional

To have the agent process lines for a specific line separation rule, you need to define a “line_pattern” regex rule.

• When you define a “line_pattern” regex rule, the agent will not process lines for New Line("\n").
  • To learn more, see Multiline Detection.

line_pattern: '^\d{4}-\d{2}-\d{2}\s+\d{2}:\d{2}:\d{2}'

tls

Optional

You can use this parameter to verify a certificate.

Enter the certificate’s path.

tls:
  crt_file: /certs/server-cert.pem
  key_file: /certs/server-key.pem
  ca_file: /certs/ca.pem