# Adding Datasource from 3rd Party Applications

**URL:** <https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714>\
**Category:** Logstash\
**Created:** [May 21, 2020, 9:51am UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714 "2020-05-21T09:51:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chad](https://avatars.discourse-cdn.com/v4/letter/c/ecccb3/32.png) [@Chad](https://discuss.elastic.co/u/Chad)\
**Post date:** [May 21, 2020, 9:51am UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714/1 "2020-05-21T09:51:28Z")

</div>

Hi,

i'm new in ELK, and i'm looking to get logs from my AD AuditPlus tool ( screenshot attached). How to do I go about it from setting it up , up to creation of dashboard.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c709aaa88461a3ec25ea894618dbd16472be1dda.png)

---

<div class="post-metadata">

**Author:** ![tamilsweet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamilsweet/32/54127_2.png) [@tamilsweet](https://discuss.elastic.co/u/tamilsweet)\
**Post date:** [May 21, 2020, 10:17am UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714/2 "2020-05-21T10:17:54Z")

</div>

Hi Chad,  
Welcome to elastic forum.  
Do you have your private ELK setup or planning to use Elastic Cloud service?

---

<div class="post-metadata">

**Author:** ![Chad](https://avatars.discourse-cdn.com/v4/letter/c/ecccb3/32.png) [@Chad](https://discuss.elastic.co/u/Chad)\
**Post date:** [May 21, 2020, 10:52am UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714/3 "2020-05-21T10:52:51Z")

</div>

Hi @tamilsweet,

I'm using a private on-prem.

---

<div class="post-metadata">

**Author:** ![Chad](https://avatars.discourse-cdn.com/v4/letter/c/ecccb3/32.png) [@Chad](https://discuss.elastic.co/u/Chad)\
**Post date:** [May 23, 2020, 5:33am UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714/4 "2020-05-23T05:33:52Z")

</div>

Hi Guys,

kindly looking for your help 🙂

---

<div class="post-metadata">

**Author:** ![tamilsweet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tamilsweet/32/54127_2.png) [@tamilsweet](https://discuss.elastic.co/u/tamilsweet)\
**Post date:** [May 25, 2020, 1:33pm UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714/5 "2020-05-25T13:33:16Z")

</div>

Looks like not many are familiar with ADAudit Plus integration with Elasticsearch including myself.

You might have to follow trial and error method to get this integration working.

I would just forward the SIEM logs to a Logstash instance and output that to stdout to see if the logs are forwarded properly as expected. I'm not sure about the Protocol, Syslog Standard and Data Format.. so try everything till you get it working.

Next step would be to get the logs pushed from Logstash to Elasticsearch. You can add some grok pattern if you want to parse the logs and store it in different fields.

I'm not sure if you can directly forward those logs to Elasticsearch. Elastic SIEM is added recently and I'm not sure how it works, check it out - [https://www.elastic.co/siem](https://www.elastic.co/siem)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 22, 2020, 1:33pm UTC](https://discuss.elastic.co/t/adding-datasource-from-3rd-party-applications/233714/6 "2020-06-22T13:33:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.