Right now I have various Beats connecting to a Graylog Input (configured the same way you would connect it to Logstash). This works really well, but what I'd prefer to do is have another Beat on the other end of the connection, with similar options including writing to disk. My goal are these 2 scenarios:
Disk -> Beat[a1] ----> Beat[b1] -> Disk
Disk -> Beat[a1] -----> Beat[b1] ----> Beat[c3] ---> Beat[d7] -> Elasticsearch
So the Beats are either an efficient way to move log data from one server to another, so you can do stuff to the data on the other end before loading it into ES/LS/GL, or the Beats can be setup in a load balancing tree for a really large distributed setup.
I know I can accomplish this with logstash, but I prefer how lightweight go-based Beats are, and trying to avoid anything Ruby related in my stack.
Anybody else think about creating a similar Beat? Does something like this already exist, maybe a POC Beat someone was working on? If I wanted to find someone to help me build this, where do I start?