Elastic Stack as a syslog relay?


(Sam) #1

Hello, I am completely new to the Elastic Stack and was wondering if the following was possible:

I want to use the Elastic stack for log collection, forensics and as a relay to LogRhythm for specific use cases. I was wondering if this was possible, anybody has tried this and what problems they may have encountered.

A key requirement would be preservation of the original log, ideally we would like to forward specific logs to Logrhythm unprocessed.

Is there a way to forward logs from ELK to Logrhythm? Preferrably raw logs (preserving original source, destination, timestamp, etc).

Thanks


(Mark Walkom) #2

I commented on your other thread as well.

But Logstash will wrap the original event in some meta fields, like time received and a few other things. So it won't be the original message being forwarded.


(Sam) #3

Thanks for the info Mark, I'll look into the config file as well.

Is there a way to know just how each packet is changed?

Thanks again,
Sam


(Mark Walkom) #4

Easiest way is to push a message through with no filters.


(system) #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.