Ive been tasked with researching ELK (Kibana, Elasticsearch, and logstash) stack to possibly use for our new project. I think I have a pretty good grip on it so far but need help answering one question that I havent been able to seem to find through research. Ill try to be as complete as possible describing our use case ! Thanks a head of time!
Question: Can Kibana or a remote client out of the box turn on some sort of additional logging to remote logstash/filebeats?
Use Case: User sees a Fatal error on Kibanas dashboard. user wants to see now all logs even debug/info logs (these logs have not been sent off to elasticsearch).
I know normally we could just filter out on Kibana so the user wont get flooded with logs and only see whats important. But one of the locations of the client that is logging has extremely limited bandwidth. As a requirement we have to keep the network usage at a minimum, sending logs along the pipeline constantly doesnt seem like an option.
The idea is to log locally and only send logs of importance to logstash. Until a user requests the logs, then could logstash/fileabeat change its configuration to send the additional logs up?
I realize that this most likely wont have an out of box solution, but is there some sort of solution possible with custom written plugins etc?