---
title: "Setting Up Logstash (with ELK stack)"
canonical: "https://docs.infoblox.com/space/BloxOneCloud/35367068/Setting%20Up%20Logstash%20(with%20ELK%20stack)"
format: markdown
---
Setting Up ELK for Use with Data Connector To set up ELK for use with Data Connector, do the following: Depending on your setup, create a new input configuration file or update an existing file. Logstash supports different plugins for accepting messages from Data Connector. Infoblox recommends using TCP input with CEF codec. The TCP port should match the TCP port configured on the Syslog destination . Restart Logstash. Configure the Syslog destination in the Infoblox Portal: FQDN/IP : the IP address or hostname of Logstash Port : the TCP port specified in the input configuration Format : the CEF output format Insecure Mode : selected       Image : The Syslog destination  configuration screen in the Infoblox Portal. For more information, see  Configuring Destinations . Configuring a Traffic Flow To push traffic to ELK, create a traffic flow and select the created destination as a destination for the traffic flow. For more information, see  Configuring Traffic Flows . Checking Events in Kibana To check events in Kibana, do the following: To view the configuration, in the side menu under Kibana, go to  Kibana >  Management  >  Index Patterns . In the  Index pattern  field, type in “cdc-syslog”. Click  Next step. In  Time Filter field name , select  @timestamp . Click  Create index pattern . Image : The  a configuration screen from the Kibana  "Create index pattern" screen. In the side menu under Kibana, go to  Discover  and select  cdc-syslog  index. Image : The  configuration screen from Kibana displaying the sdc syslog responses. Continue sending the data to Logstash: Image :  The  configuration screen from Kibana displaying the data being sent to Logstash . Estimating Performance Event types will be processed according to Logstash, the ELK configuration and Data Connector VM parameters, and the Data Connector configuration and load. The maximum Data Connector performance of Logstash via Syslog TCP is 18,000 events per second (EPS). For performance of Logstash to reach the maximum, the CEF codec was disabled and the output was configured in a file in /dev/null. To estimate EPS, you need to summarize all event types received by Data Connector. For example, if on NIOS DNS Query where DNS Response and RPZ logs are enabled, then EPS will be calculated by doubling the average of DNS QPS and adding the average of RPZ hits per second.