Log Source Ingestion Reference

Choosing the right log ingestion method for your Graylog environment starts with identifying the log sources you plan to bring into Graylog. The table below lists a wide range of supported sources, including firewalls and network appliances, cloud and SaaS providers, applications, and other popular third-party platforms.

For each source, you’ll see the log types Graylog natively supports, along with the recommended input or inputs used to ingest that data. Use this reference to find the specific inputs, formats, and setup requirements for each supported integration.

If you’re still deciding which data sources to collect, see Select and Ingest High-Value Log Sources for guidance on prioritizing your log collection strategy.

Hint: If a specific vendor or product is not listed, you can still ingest its logs using one of Graylog’s generic inputs, such as Beats, CEF, GELF, Raw/Plaintext, or Syslog. These inputs support a wide variety of data formats and are flexible enough to accommodate most custom or unsupported sources.

Log Sources

The following table lists commonly supported log sources that can be ingested into Graylog. Each entry identifies the source type, the log data it produces, and the corresponding Illuminate pack, input, and any notable configuration requirements. Use this reference to verify compatibility and determine the most effective ingestion method for your environment.

Source	Logs	Illuminate pack	Input	Setup Requirements
Apache HTTP Server	Apache2 access logs	Apache HTTPD	Beats Syslog
Apache Tomcat	Apache Tomcat access logs and Catalina logs	Apache Tomcat	Beats Syslog
Amazon Security Lake	security data logs	AWS Security Lake	AWS Security Lake Input
BIND	DNS server query and error logs	BIND DNS	Beats
Bitdefender GravityZone	Event Push Service API events logs; Bitdefender Syslog events (appliance)	Bitdefender GravityZone	Bitdefender GravityZone Input
Caddy Webserver	access logs	Caddy Webserver	Beats
Carbon Black Defense	CB Defense logs	Carbon Black Defense	Syslog
Check Point	Checkpoint Next Generation Firewall (NGFW) logs	Checkpoint Firewall	Syslog
Cisco ASA (Adaptive Security Appliances)	ASA logs	Cisco ASA	Raw/Plaintext Syslog
Cisco IOS (Internetwork Operating System)	IOS logs	Cisco IOS	Raw/Plaintext Syslog	Raw is recommended to avoid a timestamp incompatibility issue.
Cisco ISE (Identity Services Engine)	ISE logs	Cisco ISE	Syslog
Cisco Meraki	Meraki logs	Cisco Meraki	Raw/Plaintext Syslog
Cisco Umbrella	Umbrella logs	Cisco Umbrella	AWS S3 Input
Cloudflare	Cloudflare logs	Cloudflare	Raw HTTP Input
CrowdStrike Falcon	CrowdStrike Falcon logs	CrowdStrike Falcon	CrowdStrike Input
Fortinet FortiGate	Fortinet FortiGate event logs	Fortinet FortiGate	Raw/Plaintext Syslog	CEF format is not supported.
GitLab	GitLab logs	GitLab	Raw HTTP Input Raw/Plaintext
Google Workspace	Gmail, Google Calendar, Google Chat, Google Drive, Google Docs, and more	Google Workspace	Google Workspace Input	Specific log types are selected on the input.
Graylog API Security	API traffic	Graylog API Security	GELF
HAProxy LoadBalancer	Default/Connection, Error, TCP, HTTP, HTTPS, and TCP logs	HAProxy LoadBalancer	Syslog
Juniper SRX	sd-syslog formatted logs	Juniper SRX	Syslog
Linux Auditbeat	Auditbeat logs	Linux Auditbeat	Beats
Linux AuditD	AuditD event logs	Linux AuditD	Syslog
Linux System Logs	syslog and auth.log	Linux System Logs	Beats Syslog	We recommend using Sidecar with rsyslog, syslog-ng, or Filebeat.
Microsoft Defender Antivirus	event logs	Microsoft Defender Antivirus	Beats GELF
Microsoft Defender for Endpoint	alert logs	Microsoft Defender for Endpoint	Microsoft Defender for Endpoint Input
Microsoft DHCP	DHCP server event logs	Microsoft DHCP	Beats	Used with Filebeat collector.
Microsoft 365 (formerly Office 365)	Office 365 logs	Microsoft Office 365	Office 365 Log Events Input
Microsoft PowerShell	PowerShell logs	Microsoft PowerShell	Beats GELF
Microsoft Sysmon	Sysmon event logs	Microsoft Sysmon	Beats GELF	Configure Winlogbeat or NXLog to collect Sysmon from the Windows event log service.
Microsoft Windows AppLocker	AppLocker event logs	Microsoft Windows AppLocker	Beats GELF	Uses Winlogbeat or NXLog, generally with Sidecar.
Microsoft Windows DNS Server	Analytical and Audit DNS logs	Microsoft Windows DNS Server	Beats GELF	Requires Filebeat version 8.13.0+ for Analytical logs.
Microsoft Windows Security	Windows Security event logs	Microsoft Windows Security	Beats GELF	Identifies and processes all Windows logs that have not been processed by any other technology pack. Uses Winlogbeat or NXLog.
Mimecast	Archive Search, Audit Events, DLP, Search, and others	Mimecast	Mimecast Input	Specific log types are selected on the input.
NetFlow	IP traffic flow data	NetFlow	NetFlow Input
NGINX Web Server	access logs and error logs	NGINX Web Server	Beats Syslog	Either Filebeat (with Sidecar) or rsyslog are required for delivering logs.
Okta	Okta logs	Okta	Okta Log Events Input
Packetbeat	Packetbeat logs	Packetbeat	Beats
Palo Alto 11	Palo Alto logs	Palo Alto 11	Palo Alto Networks TCP (PAN-OS v11+)
pfSense/OPNsense Firewall	pfSense and OPNsense logs	pfSense/OPNsense Firewall	Syslog
Postfix Mail Server	Postfix logs	Postfix Mail Server	Syslog
Sendmail Mail Server	Sendmail logs	Sendmail Mail Server	Beats Syslog	Can use Filebeat with Sidecar.
Snort 3 IDS	Snort and AppID alerts	Snort 3 IDS	Beats	Configure Snort 3 to log in JSON format to capture detailed event information.
SonicWall NGFW	SonicWall NGFW event logs	SonicWall NGFW	Syslog
Sophos Central	Sophos Central Endpoint Protection telemetry and event messages	Sophos Central	Sophos Central Input
Sophos Firewall	Sophos Firewall logs	Sophos Firewall	Syslog
Stormshield Firewall	Stormshield logs	Stormshield Firewall	Syslog
Symantec Endpoint Detection and Response	Symantec EDR event and incident logs	Symantec Endpoint Detection and Response	Symantec EDR Events Input
Symantec Endpoint Protection	Symantec logs	Symantec Endpoint Protection	Syslog
Symantec Endpoint Security		Symantec Endpoint Security	Symantec SES Events Input
Symantec ProxySG	ProxySG events logs	Symantec ProxySG	Syslog
Ubiquiti Unifi	UniFi OS, UniFi Network, and UniFi Protect logs	Ubiquiti Unifi	Syslog	A UniFi specific input and an Illuminate lookup override must be configured.
WatchGuard Firebox	Firebox event logs	WatchGuard Firebox	Syslog
Zeek	Zeek logs	Zeek	Beats	Requires Filebeat, and Zeek must be configured to log in JSON format.

Generic Inputs

In addition, Graylog provides generic input types based on common protocols and log formats that enable you to ingest many different data sources. The following inputs can be used to accommodate a wide range of log types:

Each input type offers multiple configuration options, allowing you to select the method that best aligns with your environment and data requirements.