Logstash output as CEF data to other server

[Blason (R)]

Hi there,

I have elastic search stack where logstash is accepting data and ingesting in elastic search now I need to have another output configured and forward the data to a third part collector which is accepting in CEF format.

This is again not ArcSight but a third party SIEM solution. Can someone confirm if this possible?

TIA
Blason R

[Badger]

You can use a cef codec on an output, so yes, this should be possib.e

[Blason (R)]

If possible can you give me an example?. Here is mine at this moment and I need to send to third party collector in CEF format

        gelf {
                host => "localhost"
                port => "12201"
                protocol => "UDP"
        }

}
#       elasticsearch {
#               index => "logstash-rpzlog-%{+YYYY.MM.dd}"
#               hosts => ["http://localhost:9200"]
#               }
#       }

[Badger]

There is an example writing to stdout here.