Need to monitor multiple Log sources

Elastic Stack Elasticsearch
1

HI All,

I have 200 different Log sources which i need to monitor all of them has different IP address, what is the best possible way if any of the IP/Logsource is not sending logs to ELK, i need to generate an alert. a watch would be able to identify, but i dont know how to track the IP which is not sending logs.

2

Have you looked at this example in the examples repository on GitHub? It seems quite similar to what you are looking for?

3

Thanks Christian,

this can work for me but i don't understand that how i will define a list of IPaddress which i need to monitor.

4

This example does not work off a list of IP addresses. It just compares the sources that sent data over the most recent period to the ones that sent data earlier. If a new source is added it will therefore pick this up, and if any source is removed it will alert on that even if it is a planned removal. If you want to compare this to a fixed set of IP addresses you could do this in additional chained steps.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.