Forwarding logs from Logstash to another external location i.e SIEM

Elastic Stack Logstash
1

Hi,

I'm currently setting up an ELK stack and will be forwarding my logs to Logstash. However I also have a requirement to send these logs top a separate SIEM.

Is it possible to do this with logstash? I cant find any posts or documentation that says you can. Was hoping there would be some functionality such as with syslog-ng where you can select multiple destinations. If not I guess i'll just need to handle this by forwarding logs to a syslog server first and using this to to forward to Logstash and the SIEM,.

Thanks for your assistance.
Gordon

2

Usually you would use a TCP output, but its all depending on what SIEM you are using and what ingestion methods it offers.

3

Hi Elvar,

Thanks for the reply. We're going to use LogRhythm. i'll take a look and see if using the TCP output would work. Appreciate the help.

4

Was hoping there would be some functionality such as with syslog-ng where you can select multiple destinations.

A Logstash pipeline can have multiple outputs. Unless you specifically configure it otherwise using conditionals, all events will be sent to all outputs.

5

Exactly, very very flexible. I do recommend you do not send directly to each output but have a queue of your choice between them. Reason is that if you have 4 different outputs that everything gets sent to if one fails the whole processing pipeline of Logstash fails.

6

How did it go? Were you able to send logs from ELK stack to LogRhythm?

7

LogRhythm (at the time of writing this) uses ES 2.x under the hood. If you want to bypass their own normalization that happens at the Mediator (DP) then you can index directly into ES however they have microservices, one of which is similar to curator.

An ideal method here would be to look at the using the LogRhythm collectors to collect from logstash output.