Hello! so I'm trying to do the following:
Retrieve Linux servers logs and filter them for specific events and then pass them to a SIEM solution.
Can I achieve that on the Log Stash level?
And do I need all three layers of the stack? or can i just use Log Stash for this?
And my setup plan is as follows:
Have 3 nodes:
Server 1: install Log Stash: 8 Core CPU, 64GB RAM, 140GB SSD
Server 2: install Elastic Search: 8 Core CPU, 64GB RAM, 140GB SSD
Server 3: install Kibana: 8 Core CPU, 8GB RAM, 140GB SSD
What do you think of the specs and architecture?
All suggestions and pointers are appreciated.