Cisco Meraki

Receives syslog forwarded by the Cisco Meraki dashboard (MX, MR, and MS devices) over UDP on a configurable listen address and port, and parses the messages into structured logs.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

• A Cisco Meraki network configured to forward syslog to the collector's IP address and UDP port. Configure the syslog server in the Meraki dashboard under Network-wide > Configure > General and set its roles (Event Log, Flows, URLs, IDS alerts, and so on). See Cisco Meraki's Syslog Server Overview and Configuration for the authoritative device-side steps.
• The collector host must be reachable from the Meraki devices, and the configured UDP listen port must be open in any host and cloud firewalls between the devices and the collector.
• Binding to a privileged port (below 1024) requires running the collector with root or Administrator privileges. The default port 5140 avoids this.

Configuration

Logs

Parameter	Type	Required	Default	Description
Listen Address	String	No	0.0.0.0	An IP address for the collector to bind. Typically 0.0.0.0 for most configurations.
Listen Port	Integer	No	5140	A UDP port which the collector will listen for syslog messages.

Advanced

Parameter	Type	Required	Default	Description
Parse	Boolean	No	true	Parses the log fields into structured data.

Examples

Receive Meraki syslog on a non-privileged port

This source binds all interfaces on UDP port 5140 and parses incoming Meraki syslog into structured fields.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: cisco-meraki
spec:
  type: ciscomeraki
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: parse
      value: true

Configuration Tips

• The collector listens for Meraki syslog over UDP only. Point the Meraki syslog server at the collector's address and the matching UDP port.
• Keep the default port 5140 to avoid running the collector with elevated privileges. If you must use a port below 1024 (for example 514), run the collector as root or Administrator.
• Set Parse to true to emit structured fields; set it to false to retain only the raw syslog body.

Troubleshooting

No logs arriving

Symptoms: the source is running but no Meraki logs reach the pipeline.

Solutions:

1. Confirm the Meraki syslog server is configured in the dashboard and points at the collector's IP address and the configured UDP port, with at least one role enabled.
2. Verify the UDP listen port is open in host and cloud firewalls between the Meraki devices and the collector.
3. Confirm the collector is actually bound to the listen address and port (check that nothing else is already using the port).

Permission denied binding the port

Symptoms: the collector fails to start and logs a permission or bind error on the listen port.

Solutions: ports below 1024 require root or Administrator privileges. Either run the collector with elevated privileges or use the default 5140 (or another port above 1024).

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: cisco-meraki
spec:
  type: ciscomeraki
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: parse
      value: true

Related Resources

• Cisco Meraki — Syslog Server Overview and Configuration
• Cisco Meraki — Syslog Event Types and Log Samples