Ingesting logs from two eStreamer nodes

[gcusello]

Hi at all,
I have to ingest logs from two eStreamer nodes.
I'm already ingesting logs from the first one using eStreamer App 2.2.2, how can I have logs from the second one?

Could it be a solution to install two instances of the same app?
each one could take logs from one eStreamer node and both write on the same index, so using one App instance I could see all the logs.
I don't know if this could be a good solution.

Thank you in advance.

Bye.
Giuseppe

[micahkemp · Accepted solution]

I've looked into this, and unfortunately the only answer (for this version, which works for Firepower 5) is to run the app on multiple forwarders, one forwarder per eStreamer node.

The good news is that this wouldn't prevent the events from going into the same index.

[gcusello]

Thanks micahkemp,
Do you suggest to get data from two nodes in the same index?

is it possible to recognize event nodes?

Bye.
Giuseppe

[douglashurd]

If you move to version 6.x of firepower you will be best served to use the new TA: https://splunkbase.splunk.com/app/3662/

[rafeeqsid25]

https://splunkbase.splunk.com/app/3662/ this add-on is not suppported on Splunk Windows Environment.

[micahkemp]

The events should show the correct sensor that matched the traffic detected, but I'm not sure if the event would indicate which Firepower device the event was pulled over eStreamer from. That might be in the host field, but I don't have any eStreamer devices to test with.

[gcusello]

Ok, I'll test it.
Thank you.
Giuseppe