Logstash only in DMZ?

[vAJ]

Anyone tried or have running a separate logstash instance listening in a secure zone (DMZ) then writing back to elastic in your LAN zone?

I'm getting static from InfoSec on the fact that nxlog traffic source ports are ephemeral. Having a listener inside DMZ that wasn't part of the cluster would be great. I don't want any of the cluster data stored/sharded in the DMZ, though.

-AJ

[tmcdonald]

Logjam?

https://github.com/gocardless/logjam

[vAJ]

I guess that works. Would need to switch from om_tcp to om_udp.

Sweet. I'll have to test that out.

[mcapra]

Let us know how it works! We've only ever played around with generic forwarders. Logjam definitely looks like a superior solution for your use case.