Establish connection to Filebeat from Logstash

Elastic Stack Logstash
1

Hi All,

Let's assume an application I would like to monitor is running in a Security-Network-Zone (e.g. DMZ). It should be integrated via Filebeat into the Logstash & Elasticsearch platform running in the internal network zone.
But unfortunately the Security-Zone does not allow me to establish a connection to the internal network for security-reasons. It is only allowed, to create a connection from the internal network to the security-zone.

As the connection between Filebeat & Logstash is persistent anyway, I was thinking if there is a way to initialize the connection to Filebeat from Logstash (Internal to DMZ)? But it seems not, as I haven't found any information.

What would be your advice in that architecture to solve this requirement?

Many thanks in advance!
Chris

2

You might be able to do it by using a tunnel created using a port forwarder.

3

Can you add any other tools in the DMZ infrastructure? If so you could use Kafka.

You would need to configure your Filebeat (in the DMZ) to ship the logs to Kafka (also in the DMZ), then you would use the kafka input in logstash to pull the logs from Kafka.

This way it is your logstash server that will start the connection.

4

What you guys think about the option to use Logstash in Server-Mode in the DMZ-Zone?

input {
  file { .... }
}
filter { ... }
output {
  tcp {
    port => 5044
    host => "0.0.0.0"
    mode => "server"
  }
}

And on the internal Logstash:

input {
        tcp {
                port => 5044
                host => "10.58.143.112"
                mode => "client"
        }
}
filter { ... }
output { ... To Elasticsearch ... }

Thanks!
Chris

5

Indeed the Security Advice will not be to forward the logs to the internal zone, but implement a logs concentrator in the DMZ, in this case I think another logstash instance is the way to go.

6

It is an interesting suggestion. You would need to test what happens when each one restarts, what happens when each one starts when the other is not running etc. (If I recall correctly the output will hang in the register function until it connects.)

1 Like
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.