Hey all,
I am currently setting up an environment with Elastic and Logstash 7.3.1 to serve as a baseline SIEM environment. We have Logstash running on the app server as a pivot point and receiver for our beats and syslog, and we would like to have that data then indexed on our storage device. I would ideally like to use Kafka as a message queue in case something happens on the storage end, we won't lose our logs.
Does anyone know, do I need to have a Kafka server and a Zookeeper instance also running on our app server to facilitate the use of the Kafka output plugin, or will the output and input plugins work as a standalone without a Zookeeper instance running?
Cheers!