Getting data from Elastic Search

[ronak]

Hi

Can you share sample scripts or configuration setting for me to get data from elastic search in an incremental manner?

The source data is information about event with updated_at to get the incremental information. Other attributes include event_name, event_location, event_start_time, event_end_time

thanks, ronak

[larmesto]

This might be helpful for anyone visiting; I have started working on an addon for Elasticsearch instances, feel free to use it!
https://splunkbase.splunk.com/app/4175/

[wsnyder2]

I found this ... not sure if/how it works http://devpost.com/software/splunk-elasticsearch

[somesoni2]

Could you provide more information on what you need here? Is the data already indexed and you just want to search and get the latest/updated incremental data?

[ronak]

hi - Yes, the data resides in ES.

[chrisboy68]

Not sure what you are trying to do, but you could ship the data you already have to Elasticsearch to Splunk simultaneously. I'm doing this to evaluate both products.

Chris

[ronak]

Chris

Some system, that can send data to one destination , in my enterprise has already sent data to ES. My objective is to extract the data from ES and give to splunk for indexing.

I'm looking for a template script or configuration that someone might have already done to extract data from ES ...

Hope this helps clarify

appreciate any pointers

thanks, ronak

[pedro50]

Hi Ronak,

we are facing the same situation, would like to got ALL syslog data from elastich search to Spunk.
You have been able to solve the issue

Many txs in advance

[masonmorales]

I agree with Chris on this. Anyone looking to do this would be better off installing a UF (or HF) on the same data source that ES is using (e.g. syslog server). Even if you had an easy way to port data from ES to Splunk, you would be introducing a new point of failure, and would inherit any issues ES has with data integrity, availability, etc.