Forwarding logs to another location

[technosol]

Hi

One of our customer, looking for a way of forwarding all or selected logs in syslog or other formats to a different location and preserve the original source IP. May I know is this feasible from Nagiuos Log server?

I found some info relavent info of logstash -- > https://www.elastic.co/products/logstash

Can we do that using this filter : "Parse & Transform Your Data On the Fly" and "Choose Your Stash, Transport Your Data" ?

Regards
Chandana

[cdienger]

You can use any of the outputs listed at https://www.elastic.co/guide/en/logstas ... ugins.html to forward data on to another server. The output would becoming from the NLS IP but can include the original source IP in the message which the destination can parse out.

[technosol]

Thank you for the reply.

May I know, do you support this type of implementations? or it is completely up to us how to do the implementation using the information you have provided?

Regards
Chandana

[cdienger]

We can certainly help : ) Configuration of the destination would be a bit outside our scope but configuring the output is something we can assist with.

[technosol]

Hi

As we planned, we have 2 , 4 node Nagios LS cluster to be implemented to analyze application and system logs. While logstash sending logs to elasticsearch, I want to send those logs to another repository without changing the source IP. As I found in logstash, we are able to achieve the requirement by developing a plugin for inputs and outputs.

May I know how can you assist us to make this implemented? also please let me know

1. if there is any performance impact due to the new plugin implementation.
2. is there a way to internal load balancing the forwarding across Logstash nodes?

Thank you
Chandana

[cdienger]

Custom plugins would be beyond the scope of what we can assist with but you'll want to monitor the usual (load, cpu, memory, disk) to determine any performance problems before/during deployment.

There isn't a internal load balancing for logstash, but each instance of NLS will have logstash and inputs to accept files, so using a third party load balancing solution is an option.

[technosol]

Hi

How do we discuss further the implementation of the custom plugin? Are we able to have a private discussion, maybe via email?

Thank you

[cdienger]

You can PM me if you have any specifics that can not be shared on a public forum. To commission a custom plugin though you would want to reach out to our sales team - sales@nagios.com