{"id":19788344,"url":"https://github.com/graylog2/graylog-guide-ubiquity-unify-ap","last_synced_at":"2026-03-02T20:37:59.850Z","repository":{"id":48084528,"uuid":"70437766","full_name":"Graylog2/graylog-guide-ubiquity-unify-ap","owner":"Graylog2","description":"How to receive and parse Ubiquity Unify Access Point logs with Graylog","archived":false,"fork":false,"pushed_at":"2021-08-07T20:03:26.000Z","size":999,"stargazers_count":50,"open_issues_count":6,"forks_count":8,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-01-11T03:49:06.930Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Graylog2.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-10-10T00:03:02.000Z","updated_at":"2024-10-16T13:04:27.000Z","dependencies_parsed_at":"2022-07-28T23:08:54.291Z","dependency_job_id":null,"html_url":"https://github.com/Graylog2/graylog-guide-ubiquity-unify-ap","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ubiquity-unify-ap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ubiquity-unify-ap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ubiquity-unify-ap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Graylog2%2Fgraylog-guide-ubiquity-unify-ap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Graylog2","download_url":"https://codeload.github.com/Graylog2/graylog-guide-ubiquity-unify-ap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241125001,"owners_count":19913839,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-12T06:26:56.416Z","updated_at":"2026-03-02T20:37:59.818Z","avatar_url":"https://github.com/Graylog2.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# This guide has been archived.\nThe information in this guide is very old and likely no longer applicable to current versions of Graylog. \nPlease take that into account when reading the following content.\n\n# Writing Ubiquity Unifi WiFi Access Point logs into Graylog\n\nThis guide explains how to configure a [Ubiquity Networks Unifi Enterprise WiFi Access Point](https://www.ubnt.com/unifi/unifi-ap/) to send logs to Graylog and how to configure Graylog to parse these into nicely structured messages.\n\n![](https://github.com/Graylog2/graylog-guide-ubiquity-unify-ap/blob/master/message.png)\n\n## Configuring Graylog\n\n1. Start a _Syslog UDP_ input and remember the port you let it listen on. You'll need it later when you are pointing your access points to Graylog.\n1. Create a stream and call it _Ubiquity Access Point logs_\n1. Add one stream rule: `message must match regular expression ^\\(?\"?.+,(.+?),.+\"?\\)? (.+?): (.+)$`\n1. Create a pipeline with one stage and two steps:\n  * Parse the actual log message into fields and clean it up\n  * Search for any mac address in the message and add it as another field\n\nHere are the rules:\n\n```\nrule \"parse Ubiquity access point logs\"\nwhen\n  has_field(\"message\")\nthen\n  let m = regex(\"^\\\\(?\\\"?.+,(.+?),.+\\\"?\\\\)? (.+?): (.+)$\", to_string($message.message));\n  \n  let bssid = m[\"0\"];\n  let subsystem = m[\"1\"];\n  let clean_message = m[\"2\"];\n  \n  // Build a better source name\n  set_field(\"source\", concat(\"ap-\", to_string(bssid)));\n  \n  // Set additional fields.\n  set_field(\"type\", \"ubiquity-ap\");\n  set_field(\"bssid\", bssid);\n  set_field(\"subsystem\", subsystem); \n\n  // Set a better message field without the prefix clutter.\n  set_field(\"message\", clean_message);\nend\n```\n\n```\nrule \"parse any MAC address out of message field\"\nwhen\n  has_field(\"message\")\nthen\n  let m = regex(\"([0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2}:[0-9A-Fa-f]{2})\", to_string($message.message));\n  \n  // It's NULL if there was no match and will simply not be set internally by Graylog.\n  set_field(\"mac_address\", m[\"0\"]);\nend\n```\n\n![](https://github.com/Graylog2/graylog-guide-ubiquity-unify-ap/blob/master/pipeline.png)\n\nConnect this pipeline to your _Ubiquity Access Point logs_ stream and you are done on the Graylog side.\n\n## Configuring the Access Point\n\nIn Graylog, start a \n\nIn your Unifi Web Interface, go to \"Settings\" and enable remote syslog logging. Use the port that your _Syslog UDP_ input in Graylog is using:\n\n![](https://github.com/Graylog2/graylog-guide-ubiquity-unify-ap/blob/master/unifi.jpg)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgraylog2%2Fgraylog-guide-ubiquity-unify-ap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgraylog2%2Fgraylog-guide-ubiquity-unify-ap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgraylog2%2Fgraylog-guide-ubiquity-unify-ap/lists"}