How to forward ALL logs

Elastic Stack Logstash
1

I have the following logstash configuration file that successfully sends information to a third party location.

Effectively what i am asking is, how do i constantly send ALL the data going into elastic to this third party location. Is is a data stream thing? scroll? size? and also what would be the configuration in the index and query part of this to get ALL documents to send.


input {
 elasticsearch {
 hosts => "localhost:9200"
 ssl_enabled => true
 ssl_verification_mode => none
 api_key => "XXxxXXxxXXxxXX"
index => "logs-windows.powershell-default"
 query => '{ "query": { "query_string": { "query": "*" } } }'
 size => 60
 scroll => "60m"
 docinfo => true
 docinfo_target => "[@metadata][doc]"
}
}

output {
tcp {
host => "xxx.xxx.xxx.xxx"
port => xxxxx
codec => json_lines  
  }
}
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.