I wanna kick ELK to the curb!

[benhank]

How would I set up NLS to pull in old logs and data that has already been processed by my ELK stack?

[abrist]

This is a good question. I am going to pull in a dev on this one. More shortly.

[scottwilkerson]

Here's the quick way to accomplish this..

Add the following input to just ONE instance of your Nagios Log Server cluster
Admin -> PER INSTANCE (ADVANCED) -> Select 1 instance -> Add Input
Then, based on this input you will add something like the following to connect to your OLD ELK server

Code: Select all

input {
  # Read all documents from Elasticsearch matching the given query
  elasticsearch {
    host => "YOUR_OLD_SERVER_HOSTNAME"
    size => 10000
  }
}

Then, Apply configuration, and all of data will be pulled into Log Server from your existing ELK stack.

[benhank]

all set can be locked