# Configure Fluent-Bit to send logs to ELK ## Prerequisites: Fluent-Bit: Let's begin by installing Fluent-Bit on Windows.

We have a log file named ***`network_sample.log`*** that we need to be ingested into the ELK stack. To ensure accurate data extraction, we will begin by crafting an appropriate regular expression to parse the required information. ```regex SRC=(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s+DST=(?\d{1,3}.\d{1,3}.\d{1,3}. \d{1,3})\s+PROTO=(?\w+)\s+SPT=(?\d+)?\s+DPT=(?\d+)?\s+ LEN=(?\d+)?\s+ACTION=(?\w+) ```

A line does not match the current regular expression. Let's create a new one to accommodate it. ```regex SRC=(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\s+DST=(?\d{1,3}.\d{1,3}.\d{1,3}. \d{1,3})\s+PROTO=(?\w+)\s+TYPE=(?\w+)\s+CODE=(?

\d+)\s+ID=(?\d
+)\s+ACTION=(?\w+)
```



Next, we need to modify the **`parsers.conf`** file located in **`C:\Program Files\fluent-bit\conf`.**



Next, we need to configure the `fluent-bit.conf` file, located at `C:\Program Files\fluent-bit\conf`, to forward logs to the ELK stack.

```yaml
[INPUT]
    Name         tail
    Parser       firewall-logs-1
    Path         C:\Users\NV\Downloads\network_sample.log
    Tag          firewall.logs-1

[INPUT]
    Name         tail
    Parser       firewall-logs-2
    Path         C:\Users\NV\Downloads\network_sample.log
    Tag          firewall.logs-2
    
[OUTPUT]
    name    	  es
    match   	  *
    Host    	  192.168.204.146
    Port    	  9200
    Match   	  *
    HTTP_User     elastic
    HTTP_Passwd   =Op+25maKY3GqC=IrV7m
    tls           on
    tls.verify    off 
    Trace_Output  on 
    Suppress_Type_Name on
```



This configuration is for **Fluent Bit** to read logs from a file (`C:/Users/NV/Downloads/network_sample.log`) and forward them to an **Elasticsearch** instance.

* **`name tail`**: The `tail` input plugin reads log files line by line, similar to the `tail -f` command in Linux.
* **`parser firewall-logs-1`**: Defines the parser used for processing log entries. The `firewall-logs` parser is specified in the `parsers.conf` file to extract structured fields from the logs efficiently.
* **`path C:/Users/NV/Downloads/network_sample.log`**: The path to the log file to monitor. Fluent Bit will read new lines appended to this file.

For the **`OUTPUT`**:

* **`name es`**: The `es` output plugin sends logs to Elasticsearch.
* **`Host 192.168.204.146`**: The IP address or hostname of the Elasticsearch server.
* **`Port 9200`**: The port where Elasticsearch is listening (default is 9200).
* **`tls on`**: Enables TLS/SSL encryption for communication with Elasticsearch.
* **`tls.verify off`**: Disables certificate verification.
* **`Trace_Output on`**: Enables verbose logging for debugging purposes.

Now, let's run Fluent Bit:

```powershell
 & 'C:\Program Files\fluent-bit\bin\fluent-bit.exe' -c 
 'C:\Program Files\fluent-bit\conf\fluent-bit.conf'
```



We need to duplicate specific lines within the ***`network_sample.log`*** file and save the changes.

Let's confirm whether the logs are successfully being forwarded to ELK.






---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://faresbltagy.gitbook.io/footprintinglabs/build-elk-lab/configure-fluent-bit-to-send-logs-to-elk.md?ask=
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.