Can ELK configure Remote Syslog Forwarding to Third party syslog server?

[wcpoon (Woody)]

Hi All,

Can ELK Stack able to configure remote syslog forwarding to another syslog server?

Kindly please advise.

Thanks.

[warkolm (Mark Walkom)]

The Elastic Stack cannot configure a syslog server, no.

You might be able to use Fleet to have Filebeat listen on the syslog port and send to another server though.

[wcpoon (Woody)]

Do you mean, I want to forward the syslog from ELK to splunk or other SIEM product, it is not possible?
If possible, do you have any guidelines can share with me?

[warkolm (Mark Walkom)]

What exactly do you want to do?

[wcpoon (Woody)]

Hi,

Currently, most of my syslog will be send over to ELK Stack via logstash / filebeat.
I want check, whether ELK Stack can forward another copy to remote syslog server (Such as, Splunk, another SIEM)?
If yes, what should I do to achieve that?

Thanks.

[warkolm (Mark Walkom)]

You can do that with Logstash, using the Elasticsearch input and the rsyslog output.