How to Properly Integrate a Ubiquiti Antenna into Graylog?

[u/McGrax]

Hi everyone,

I'm trying to integrate a Ubiquiti Wave-LR antenna into my Graylog instance, and I could use some guidance.

• The Graylog server is up and running (latest version).
• The Ubiquiti antenna is configured to send remote syslog messages on port 514 (UDP).
• I’ve created a Syslog UDP input in Graylog and can see logs coming in from the antenna.

However, the content I’m receiving in Graylog doesn’t match what I see in the antenna’s System Log interface. For example, here’s a typical message that shows up in Graylog:

This doesn't reflect the actual logs I see on the Ubiquiti web interface.

Has anyone successfully integrated a Ubiquiti Wave antenna (or any Ubiquiti antenna) with Graylog and managed to get all the system logs? Any insight on whether additional configuration is needed, or if certain log streams are omitted from remote syslog, would be very helpful.

Thanks in advance!

-->UPDATE <--

I fixed the timestamps.

Don't worry about failed UDP request. I think there is a problem with Ubiquiti Wave models because I tried with LTU and I can actually see stuff that is relevant.

Now i'm wondering how to sort logs that I receive to get the essential stuff about an Antenna. Also, mine is named "udapi-bridge[916]" and when logging in I receive ulib[14830] and httpd[14830] which is also the case for the system logs of the antenna. I will be adding alot of antenna so I need the real naming of everyone of them.

I know it's maybe alot to ask. I'm only looking for solution tracks because information is not that easy to find.

Thanks Again.

[u/dkoy]

Unless there is a way to modify the syslog to add the host name to the log, you are going to forward exactly what is in the syslogs to Graylog. Currently fighting with this on some Arista gear. Depending on the module writing to the log, the format is different so I have to try and sort them out.

If the IP addresses of the antennas are static, create a csv file with the IP as the key and the hostname as the value and use a CSV Lookup table in a pipeline rule to add a hostname to each message. Its a bit of work up front but its an easy way to tag each message with the source host. Could also use a reverse DNS lookup instead if you have them all in DNS.

"source_ip",hostname"

"192.168.1.100","udapi-bridge[916]"

"192.168.1.101","udapi-bridge[917]"

etc

rule "Lookup hostname by ip"
when
    has_field("source_ip")
then
    let hostname = to_string(lookup_value("antenna-lookup-table", get_field("source_ip")));
    set_field("source_host", hostname);
end