Ubiquiti

Receives syslog from Ubiquiti and UniFi devices over UDP on a configurable listen port and parses the messages into structured logs. Each device sends syslog directly to the collector, so the collector must be reachable from the devices themselves.

Supported Telemetry Types

Platform	Metrics	Logs	Traces
Linux		✓
Windows		✓
macOS		✓

Prerequisites

You need one or more Ubiquiti or UniFi devices configured to forward syslog to the collector, and a collector reachable from those devices on the chosen UDP port.

• Collector side: open the configured UDP listen port (default 5140) in any host and cloud firewalls between the devices and the collector. Binding to a privileged port (below 1024) requires the collector to run with root/Administrator privileges, so the default 5140 avoids that.
• Device side: enable remote syslog on the Ubiquiti/UniFi devices and point the syslog server address and port at the collector. UniFi devices send syslog directly to the configured server; the UniFi Network controller distributes the setting but does not proxy or forward the logs. Set up remote logging using Ubiquiti's official documentation rather than steps reproduced here.

  • UniFi System Logs & SIEM Integration

Configuration

Logs

Parameter	Type	Required	Default	Description
Listen Address	String	No	0.0.0.0	An IP address for the collector to bind. Typically 0.0.0.0 for most configurations.
Listen Port	Integer	No	5140	A UDP port which the collector will listen for syslog messages.

Advanced

Parameter	Type	Required	Default	Description
Timezone	Timezone	No	UTC	The timezone to use when parsing timestamps.
Parse	Boolean	No	true	Parses the log fields into structured data.

Examples

Receive UniFi syslog on a non-privileged port

Bind to all interfaces on UDP 5140 and parse the incoming messages into structured fields. Point the UniFi Remote Logging server address at this collector's IP and set its port to 5140.

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: ubiquiti
spec:
  type: ubiquiti
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: parse
      value: true

Configuration Tips

• Ubiquiti and UniFi devices send syslog over UDP. Make sure the device's syslog port matches the collector's Listen Port.
• The default Listen Port 5140 is non-privileged, so the collector does not need elevated privileges. Only choose a port below 1024 (for example 514) if you run the collector as root/Administrator.
• Leave Parse enabled to get structured fields. Disable it only when you want to forward the raw syslog message unmodified.
• Set Timezone to match the devices when their timestamps are not in UTC, so parsed event times are correct.

Troubleshooting

No logs arriving

Symptoms: the source is running but no Ubiquiti logs reach the pipeline.

Solutions:

1. Confirm each device's Remote Logging is enabled and points at the collector's IP and the configured UDP port.
2. Verify the Listen Port matches the port set on the devices and that host/cloud firewalls allow inbound UDP on that port.
3. Confirm the devices can reach the collector directly, since UniFi devices send syslog themselves rather than through the controller.

Permission denied binding the listen port

Symptoms: the collector fails to start or bind the port.

Solutions:

1. Use the default 5140 or another port above 1024, which does not require elevated privileges.
2. If you must use a port below 1024 (such as 514), run the collector with root/Administrator privileges.

Logs arrive but fields are not parsed

Symptoms: events show up but lack structured fields.

Solutions:

1. Confirm Parse is enabled.
2. Check that Timezone matches the devices so timestamps parse correctly.

Standalone Source

apiVersion: bindplane.observiq.com/v1
kind: Source
metadata:
  name: ubiquiti
spec:
  type: ubiquiti
  parameters:
    - name: listen_ip
      value: "0.0.0.0"
    - name: listen_port
      value: 5140
    - name: timezone
      value: "UTC"
    - name: parse
      value: true

Related Resources

• UniFi System Logs & SIEM Integration