https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349405#M64124 <P>one of our end-user clients have massive information stored in ELK stack. Our company needs to collect those data into Splunk using Splunk Universal forwarder . They can't send us fluentd due to firewall restrictions.</P> <UL> <LI>How can Splunk UF read from logstash? Does it have to query ELK api to do this?</LI> <LI>Can Splunk UF do polling to get data on a regular basis?</LI> </UL> <P>Worse case I'm asking them to write the data into a file , but wanted to see Splunk UF native intergration to ELK if its present</P> Thu, 02 Nov 2017 12:30:38 GMT koshyk 2017-11-02T12:30:38Z https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349405#M64124 <P>one of our end-user clients have massive information stored in ELK stack. Our company needs to collect those data into Splunk using Splunk Universal forwarder . They can't send us fluentd due to firewall restrictions.</P> <UL> <LI>How can Splunk UF read from logstash? Does it have to query ELK api to do this?</LI> <LI>Can Splunk UF do polling to get data on a regular basis?</LI> </UL> <P>Worse case I'm asking them to write the data into a file , but wanted to see Splunk UF native intergration to ELK if its present</P> Thu, 02 Nov 2017 12:30:38 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349405#M64124 koshyk 2017-11-02T12:30:38Z https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349406#M64125 <P>Interesting, a thread about the opposite direction - <A href="https://answers.splunk.com/answers/288041/can-we-use-a-splunk-universal-forwarder-to-forward.html">Can we use a Splunk universal forwarder to forward logs to an ELK server (Kibana)?</A></P> Thu, 02 Nov 2017 14:15:11 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349406#M64125 ddrillic 2017-11-02T14:15:11Z https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349407#M64126 <P>Yes, you can do in multiple ways</P> <OL> <LI>Configure logstash send the data over to Splunk using tcp output plugin and create tcp input on Splunk</LI> <LI>On logstash use http output plugin to send to Splunk</LI> <LI>Config logstash to write the events to log file and have Splunk forwards to read and send to Splunk indexes</LI> </OL> Sun, 17 Dec 2017 22:32:06 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349407#M64126 jayannah 2017-12-17T22:32:06Z https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349408#M64127 <P>Hi.<BR /> Can you help me with option too . i am not able to work that out. examples would help</P> Fri, 28 Feb 2020 14:18:39 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349408#M64127 ragmenion 2020-02-28T14:18:39Z https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349409#M64128 <P>Hello Can you help with option 2. examples are appreciated</P> Fri, 28 Feb 2020 14:19:25 GMT https://community.splunk.com/t5/Getting-Data-In/Using-Splunk-Universal-Forwarder-to-collect-from-ElasticSearch/m-p/349409#M64128 ragmenion 2020-02-28T14:19:25Z