Section – Reporting

GUI	Description
Local reporting	If enabled, all logs are sent to the local Elasticsearch database.
Remote reporting	If enabled, all logs are sent to the specified remote Elasticsearch database.
Remote reporting URL(s)	Specifies one or more remote reporting server URLs. Separate multiple URLs with commas. Configure the username and password in the corresponding Username and Password fields. Examples: `http://elastic-cluster:9200` `https://elasticsearch.mydomain.com:9200` `https://reporting1.example.com,https://reporting2.example.com` When multiple URLs are configured, syslog-ng distributes log messages across the specified URLs by assigning worker threads evenly to each target. Each log message is sent to only one URL. Failed targets are automatically removed from rotation and retried after 60 seconds. Risk Do not use HTTP for remote reporting, and do not use highly privileged user accounts. Use HTTPS and authenticate with a dedicated user account that has only the permissions required for remote reporting. Do not include credentials in the URL. If the remote reporting server requires authentication, enter the credentials in the Username and Password fields — e.g., for a remote reporting server that was previously configured as: `https://user:secretpw@elasticsearch.mydomain.com:9200`, use the following values instead: Remote reporting URL(s): `https://elasticsearch.mydomain.com:9200` Username: `user` Password: `secretpw`
Username	Specifies the username used to authenticate Airlock Gateway when sending logs to the configured remote Elasticsearch database. Required only if remote reporting is enabled and the remote Elasticsearch database requires authentication. Use a user with limited rights.
Password	Specifies the password for the configured username. Required only if remote reporting is enabled and the remote Elasticsearch database requires authentication.