---
title: "F5 BIG-IP"
slug: "f5-big-ip"
updated: 2024-12-19T18:15:03Z
published: 2024-12-19T18:15:03Z
canonical: "docs.databee.buzz/f5-big-ip"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# F5 BIG-IP

F5 BIG-IP is an application delivery and security platform designed to improve the performance, availability, and security of applications deployed in on-premises, cloud, or hybrid environments. It is widely used for load balancing, traffic management, and application security, ensuring seamless and secure access to applications for users.

This feed source supports F5 LTM, ASM and APM products.

**Integration Method:** Syslog, HTTP Collector via F5 Telemetry Streaming

**Tables**: HTTP Activity, Network Activity

#### Setup Overview

Data ingestion with this data source is via the HTTP collector. To leverage this, the setup will be in several steps:

- DataBee
  - Creating a F5 BigIP datasource and getting the API key
  - Getting the datasource_id from the DataBee console
  - Getting the URL where F5 TS will send the data to
  - Getting the tenantid
- BigIP
  - Setting up telemetry streaming

#### DataBee Configuration

1. Log into the DataBee console, navigate to the Data>Datasources tab and click on Add Data Source. Search for “bigip" and click it

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-kzflo6l2.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Select HTTP Collector as the ingest mechanism

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-eapfnxbn.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Fill in the basic contact information

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-kw1aj16j.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Select the defaults on the next dialog box
2. Click on generate new API key. Save this **API Key** as it will be used later. Click Submit

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-08xchwpi.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Navigate back to the Data>Datasource tab and click on the newly created F5 BIGIP card and copy the ID. This is the **datasource_id** that will be used later.

![A screenshot of a data report Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-2so2hhj7.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. From the console, navigate to the system

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-9uvl9o3k.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Go to the HTTP Collector box and copy the Endpoint URL. We will require the **domain**. In this example us-demo-2-api.demo.databee.buzz is the domain. It will be used at a later step. ![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-keph0lfw.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)
2. Navigate to “My Profile” and copy the **Tenant ID** value

![A screenshot of a computer Description automatically generated](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-1iklg4g3.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

### BigIP Configuration

This integration leverages the DataBee HTTP collector. Events are sent via HTTPs. The logs can also be sent via syslog. To leverage this transport mechanism, F5 telemetry streaming has to be set up.

In the sample diagram below, DVWA is the application protected by F5.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-shn2sa22.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

For more information on F5 telemetry streaming, refer to:

- [https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest](https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest),
- [https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/userguide/event-listener.html#configure-logging-using-tmsh](https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/userguide/event-listener.html#configure-logging-using-tmsh)

#### Initial Setup

Downloading the RPM file

- Install Telemetry Streaming package into F5 BIG-IP. Refer to [https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/quick-start.html](https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/quick-start.html)
- Navigate to iApps > Package Management LX and install the following packages:
  - F5-service-discovery [https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest/userguide/installation.html](https://clouddocs.f5.com/products/extensions/f5-appsvcs-extension/latest/userguide/installation.html)
  - F5-appsvcs [https://github.com/F5Networks/f5-appsvcs-extension/releases/download/v3.53.0/f5-appsvcs-3.53.0-7.noarch.rpm](https://github.com/F5Networks/f5-appsvcs-extension/releases/download/v3.53.0/f5-appsvcs-3.53.0-7.noarch.rpm)
  - F5-telemetry [https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/installation.html](https://clouddocs.f5.com/products/extensions/f5-telemetry-streaming/latest/installation.html)

#### Configure Logging Manually

If you are using a standard BIG-IP system (one that does not have restrictions on the number of virtual servers like the Per-App VE), use the following guidance to initially configure the system.

1. Create an iRule (localhost forwarder). Local Traffic > iRules > iRule List

| iRule Name | telemetry_local_rule |
| --- | --- |
| Definition | when CLIENT_ACCEPTED { node 127.0.0.1 6514 } |

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-z38aelk6.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Create the virtual server for the local listener. Local Traffic > Virtual Servers > Virtual Server List

| Name | telemetry_local |
| --- | --- |
| Description | Only required when TS is a local listener |
| Source Address | 0.0.0.0/0 |
| Destination Address/Mask | 255.255.255.254 |
| Service Port | 6514 |
| Protocol Profile (Client) | f5-tcp-progressive |
| Source Address Translation | Auto Map |
| iRules | telemetry_local_rule |
| Default Persistence Profile | source_addr |

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-ixyo3gpv.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Create the pool. Local Traffic > Pools > Pool List

| Name | Telemetry |
| --- | --- |
| Health Monitors | tcp |
| New Members | Address: 255.255.255.254 Service Port: 6514 |

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-d3gj6aip.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Create the Log Destination (Remote HSL): System > Logs > Configuration > Log Destinations

| Name | telemetry_hsl |
| --- | --- |
| Type | Remote High-Speed Log |
| Pool Name | Telemetry |
| Protocol | TCP |

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-kkxojl71.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Create the Log Destination (Format): System > Logs > Configuration > Log Destinations

| Name | telemetry_formatted |
| --- | --- |
| Type | splunk |
| Forward To | telemetry_hsl |

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-sokxklo9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Create the Log Publisher: System > Logs > Configuration > Log Publisher

| Name | telemetry_publisher |
| --- | --- |
| Destinations | telemetry_formatted |

##### ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-41x64cs1.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

#### LTM Request Log profile

The Request Logging profile gives you the ability to configure data within a log file for HTTP requests and responses, in accordance with specified parameters.

Create an LTM Request Log Profile using the following TMSH command. Note: If you are creating the profile in the user interface, the \ are not required.

IMPORTANT: This step has been updated with the TS 1.18 release to include LTM response logging.

Create LTM Profile:

1. Create a LTM Request Log Profile: Local Traffic > Profiles > Other > Request Logging > New Request Logging Profile

| Name | telemetry_traffic_log_profile |
| --- | --- |
| Parent Profile | request-log |
| Request Logging | Enabled |
| Template | event_source="request_logging",hostname="$BIGIP_HOSTNAME",client_ip="$CLIENT_IP",server_ip="$SERVER_IP",http_method="$HTTP_METHOD",http_uri="$HTTP_URI",virtual_name="$VIRTUAL_NAME",event_timestamp="$DATE_HTTP" |
| HSL Protocol | TCP |
| Pool Name | telemetry |
| Response Logging | Enabled |
| Log By Default | Enabled (Tick Mark) |
| Template | event_source="response_logging",hostname="$BIGIP_HOSTNAME",client_ip="$CLIENT_IP",server_ip="$SERVER_IP",http_method="$HTTP_METHOD",http_uri="$HTTP_URI",virtual_name="$VIRTUAL_NAME",event_timestamp="$DATE_HTTP",http_statcode="$HTTP_STATCODE",http_status="$HTTP_STATUS",response_ms="$RESPONSE_MSECS" |
| HSL Protocol | TCP |
| Pool Name | telemetry |

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-szp1oxv3.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

1. Attach the profile to the virtual server:

Navigate to Local Traffic > Virtual Servers > Virtual Server List > [Virtual Server Name] Go to Configuration: Advance search for “Request Logging Profile” add telemetry_traffic_log_profile

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/f5-bigip-image-e749mj4v.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A37%3A04Z&se=2026-10-30T12%3A37%3A04Z&sr=c&sp=r&sig=JpstKkOQr2A4kMaeaUuHo7XzTCALsan5pVa%2B9N%2BkTQA%3D)

#### Declarations

This step is used to tell F5 BIGIP about the DataBee collector. It is pushed to F5 BigIP via a HTTP call. You will need to get the following information from DataBee

- HTTP domain - Only use the domain
- APIkey
- TenantID
- Datasource ID

Once you have this information, use a CURL command or tool like Postman to make the HTTP request.