Logchase
Book a demo

Centralized log management: Every source. Every event. One clear view.

Collect, normalize and search your log data from a single workspace.

Book a demoExplore capabilities

  • Collect

    Ingest logs from anywhere

  • Normalize

    Structure data automatically

  • Search

    Find events in real time

  • Retain

    Keep logs for as long as you need

Bring every log into focus.

Collect logs from your entire environment — on-premises, cloud and hybrid — into a single platform.

  • Servers
  • Firewalls
  • Applications
  • Databases
  • Cloud services
  • Containers
Logchase

Log Management

Wide source support.
Flexible ingestion.

Ingest logs from virtually any system, application or device using industry-standard protocols and flexible collection methods.

Supported ingestion methods

  • Syslog
  • REST API
  • File collection
  • Agents

Sources and collection

Connect the sources you already run.

Centralized log collection starts here: Logchase works as a central syslog server and also accepts logs over REST API, file collection, database polling and agents. Centralize log management for on-premises, cloud and hybrid sources and keep every log ready for analysis.

  • Syslog over UDP and TCP

    Point firewalls, switches, routers and Linux servers at Logchase. Multi-line messages, such as PostgreSQL logs, are joined back together.

  • REST API

    Send JSON events from your own applications. Each API source gets its own key and can be limited to allowed IP addresses.

  • File collection

    Collect the log files that applications and systems write to disk.

  • Database polling

    Read new rows from database tables on a schedule, picking up where the last read stopped.

  • Agents

    Forward Windows event logs with an agent such as NXLog. The Logchase FIM agent reports file changes on Linux and Windows.

Supported source types

  • Network and security devices

    • FortiGate
    • Palo Alto Networks
    • Cisco ASA
    • Juniper
    • MikroTik

  • Operating systems

    • Linux
    • Windows
    • Windows Event Log and Active Directory

  • Databases

    • MySQL
    • Microsoft SQL Server
    • PostgreSQL
    • Oracle
    • MongoDB

  • Web servers and hosting panels

    • Nginx
    • Apache
    • IIS
    • cPanel / Plesk / DirectAdmin cURL logs

  • Your own applications

    • JSON
    • key=value
    • Custom parsers

JSON and key=value logs are parsed automatically. For other formats, custom parsers are available from the Advanced package up.

Raw data.
Ready for investigation.

Automatically parse and normalize logs from any source, enrich them with context and store them in a consistent schema for faster, more effective investigations.

  • Consistent event fieldsStandardize data from different sources.
  • Context preservedKeep important details and relationships.
  • Searchable structured dataTurn raw logs into actionable insights.

Find the event
that matters.

Ingest logs from virtually any system, quickly find the logs you need, from simple queries to advanced investigations.

  • Full-text searchSearch across all logs with real-time results.
  • Field-based filteringFilter by source, severity, user, IP and more.
  • Time-range analysisExplore events across any time range.
  • Query languageCombine fields with AND, OR and wildcards to narrow results.

Log analysis

Search with real queries.

Type a query, pick a time range and results come back from every source at once. Queries use a simple field:value syntax:

  • field:value matches a parsed field such as srcip, action or event_id; * works as a wildcard, as in srcip:192.168.*.
  • AND, OR, NOT and parentheses combine conditions. Terms are joined with AND by default.
  • Quoted phrases and words without a field search the raw log text.
  • Time range, source and severity filters next to the query narrow the results further.

Example queries

  • srcip:203.0.113.45

    Every event from one IP address, across all sources that record a source IP, such as firewall and Windows logs.

  • device_type:fortigate AND action:deny

    Traffic blocked by FortiGate firewalls.

  • event_id:4625 AND target_user:administrator

    Failed Windows logons for the administrator account.

  • device_type:linux AND "Failed password"

    Failed SSH password attempts on Linux servers.

  • level:(error OR critical) AND device_type:postgresql

    Errors and critical messages from PostgreSQL databases.

Protect the integrity.
Preserve the evidence.

Maintain log integrity from collection through retention, so you can trust your data when it matters.

  • Cryptographic hashingGenerate hashes to detect tampering.
  • TimestampingRecord when logs are collected and stored.
  • Integrity verificationVerify data has not been modified.

Retention and integrity

Keep logs as long as you need.

You decide how long logs are kept, based on your own needs and the regulations that apply to you. Logchase takes care of the rest:

  • Searchable, then archived

    Recent logs stay in the search index. Older logs move into compressed daily archive files automatically.

  • Full-detail SIEM archive

    The SIEM archive keeps every parsed field and can be restored to the index when an investigation needs older data.

  • A hash for every record

    Each log gets a SHA-256 hash when it arrives, so you can verify later that it has not been changed.

  • Timestamped archives

    Archive files carry an RFC 3161 timestamp that proves they existed in exactly that form at that time.

  • Disaster recovery

    Enterprise and Elite packages replicate logs to a second site, including a backup of the 5651 archive.

Law No. 5651

Legal logging in Türkiye (Law No. 5651)

Türkiye’s Law No. 5651 and its regulations require organizations that provide internet access, such as hotels, cafés, schools and companies offering Wi-Fi to staff and guests, to keep certain traffic records and protect their integrity with time-stamping. Logchase runs this process on the same platform as your security logs:

  1. 1

    Separate 5651 archive

    Traffic records go to their own daily archive, kept apart from the SIEM archive.

  2. 2

    Minimal CSV format

    Each line holds the core traffic fields: date and time, source IP and port, destination IP and port, protocol and packet size.

  3. 3

    RFC 3161 time-stamping

    Each archive file is time-stamped by TÜBİTAK Kamu SM Zamane or FreeTSA, and the timestamp response is stored with it.

  4. 4

    Integrity verification

    Verify any archive against its timestamp from the console, and search the 5651 archive when a request comes in.

  • Rule templates for 5651 user activity and NAT session logging.
  • Retention for the 5651 archive is set separately from the SIEM archive.

Obligations and retention periods depend on your type of organization; confirm them against the current regulation and with your legal advisor. Related reading: How long should you keep security logs?

See patterns as they happen.

Real-time log analytics help you identify trends, anomalies and potential issues before they become incidents.

Plan for continuity.

Replicate logs to a secondary environment to ensure your data is always available.

Primary environment

Collecting logs
from all sources

Active

Replica environment

Receiving and indexing
log data

In sync

Common use cases.

  • Troubleshoot incidentsQuickly find the root cause of issues across systems and applications.
  • Support audit workflowsAccess complete, searchable logs for compliance and reporting.
  • Improve operational visibilityGain a unified view of activity across your entire environment.

Log management in practice.

  • Example

    Security investigation

    A firewall alert flags repeated connections from an unfamiliar IP address. One search for that address across firewall and Windows logs shows which accounts it tried and whether any login succeeded. Results sorted by time then give you the sequence for the incident report.

  • Example

    Operational troubleshooting

    Users report errors right after a release. Filtering errors from the application and database sources over the last hour shows that database connection errors began minutes after the deployment, which points the team to the root cause without logging in to each server.

  • Example

    Audit and compliance

    An auditor asks who was added to a privileged group last quarter. Windows group membership events (4728 and 4732) answer it in a single search, archived logs can be restored for older periods, and hashes and timestamps show the records were not altered.

FAQ

Centralized log management FAQ

What is log management?

Log management is the collection, normalization, retention and search of records produced by servers, network devices, applications and cloud services. Centralized log management keeps all of those records in one platform, so you can find the right event in seconds and investigate the past.

Why centralize log management?

When logs stay on each server and device, an investigation means signing in to system after system, and records can be lost or altered. Teams centralize log management so every source is searchable from one place, retention is set once and evidence stays intact. Centralized log management also gives the SIEM a single, normalized data set to correlate.

Which collection methods does Logchase support?

Syslog over UDP and TCP, REST API, file collection, database polling and agents, across on-premises, cloud and hybrid environments.

How long can logs be retained?

You set the retention period based on your needs and regulatory requirements. Retention for the 5651 archive and the full-detail SIEM archive is set separately.

How is log integrity protected?

Logchase stores a SHA-256 hash for every log record when it arrives and signs archive files with RFC 3161 timestamps, so you can show during an investigation or audit that logs have not been altered.

Why does normalization matter?

Each source writes events differently. Normalization maps them to common fields, so one query searches and correlates across all sources.

Can Logchase act as a syslog server?

Yes. Logchase receives syslog over UDP and TCP alongside REST API, file collection and agents, so firewalls, switches and Linux servers can send logs directly to it.

Turn your logs into answers.

See Logchase Log Management in action with a personalized demo.

Book a demoExplore the SIEM platform