Using Splunk Universal Forwarder to collect from ElasticSearch/Logstash

[koshyk]

one of our end-user clients have massive information stored in ELK stack. Our company needs to collect those data into Splunk using Splunk Universal forwarder . They can't send us fluentd due to firewall restrictions.

• How can Splunk UF read from logstash? Does it have to query ELK api to do this?
• Can Splunk UF do polling to get data on a regular basis?

Worse case I'm asking them to write the data into a file , but wanted to see Splunk UF native intergration to ELK if its present

[jayannah · Accepted solution]

Yes, you can do in multiple ways

1. Configure logstash send the data over to Splunk using tcp output plugin and create tcp input on Splunk
2. On logstash use http output plugin to send to Splunk
3. Config logstash to write the events to log file and have Splunk forwards to read and send to Splunk indexes

[ragmenion]

Hello Can you help with option 2. examples are appreciated

[ragmenion]

Hi.
Can you help me with option too . i am not able to work that out. examples would help

[ddrillic]

Interesting, a thread about the opposite direction - Can we use a Splunk universal forwarder to forward logs to an ELK server (Kibana)?