Logstash output as CEF data to other server

Hi there,

I have elastic search stack where logstash is accepting data and ingesting in elastic search now I need to have another output configured and forward the data to a third part collector which is accepting in CEF format.

This is again not ArcSight but a third party SIEM solution. Can someone confirm if this possible?

Blason R

You can use a cef codec on an output, so yes, this should be possib.e

If possible can you give me an example?. Here is mine at this moment and I need to send to third party collector in CEF format

        gelf {
                host => "localhost"
                port => "12201"
                protocol => "UDP"

#       elasticsearch {
#               index => "logstash-rpzlog-%{+YYYY.MM.dd}"
#               hosts => ["http://localhost:9200"]
#               }
#       }

There is an example writing to stdout here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.