topic Getting data from Elastic Search in Splunk Search

Getting data from Elastic Search

ronak — Mon, 28 Sep 2020 18:38:54 GMT

Can you share sample scripts or configuration setting for me to get data from elastic search in an incremental manner?

The source data is information about event with updated_at to get the incremental information. Other attributes include event_name, event_location, event_start_time, event_end_time

thanks, ronak

Re: Getting data from Elastic Search

somesoni2 — Fri, 16 Jan 2015 18:59:53 GMT

Could you provide more information on what you need here? Is the data already indexed and you just want to search and get the latest/updated incremental data?

Re: Getting data from Elastic Search

ronak — Fri, 16 Jan 2015 20:05:29 GMT

hi - Yes, the data resides in ES.

Re: Getting data from Elastic Search

chrisboy68 — Fri, 16 Jan 2015 20:28:33 GMT

Not sure what you are trying to do, but you could ship the data you already have to Elasticsearch to Splunk simultaneously. I'm doing this to evaluate both products.

Chris

Re: Getting data from Elastic Search

ronak — Fri, 16 Jan 2015 20:54:28 GMT

Chris

Some system, that can send data to one destination , in my enterprise has already sent data to ES. My objective is to extract the data from ES and give to splunk for indexing.

I'm looking for a template script or configuration that someone might have already done to extract data from ES ...

Hope this helps clarify

appreciate any pointers

thanks, ronak

Re: Getting data from Elastic Search

pedro50 — Mon, 28 Sep 2015 13:18:51 GMT

Hi Ronak,

we are facing the same situation, would like to got ALL syslog data from elastich search to Spunk.
You have been able to solve the issue

Many txs in advance

Re: Getting data from Elastic Search

masonmorales — Mon, 28 Sep 2015 14:12:14 GMT

I agree with Chris on this. Anyone looking to do this would be better off installing a UF (or HF) on the same data source that ES is using (e.g. syslog server). Even if you had an easy way to port data from ES to Splunk, you would be introducing a new point of failure, and would inherit any issues ES has with data integrity, availability, etc.

Re: Getting data from Elastic Search

wsnyder2 — Tue, 24 May 2016 15:31:34 GMT

I found this ... not sure if/how it works http://devpost.com/software/splunk-elasticsearch

Re: Getting data from Elastic Search

larmesto — Tue, 25 Sep 2018 18:50:34 GMT

This might be helpful for anyone visiting; I have started working on an addon for Elasticsearch instances, feel free to use it!
https://splunkbase.splunk.com/app/4175/