Logstash to Logstash

[ColeVan]

Hello everyone!

I'm working on redirecting output from an external Logstash to Security Onion Logstash over port 5055. Is there a simpler way to accomplish this task? I'm reworking everything from one of my earlier post this year. Any suggestions or guidance would be greatly appreciated. Thanks!!

#12223

[reyesj2]

You should be able to setup the external logstash to send its logs to the SO manager over port 5056 using the lumberjack output plugin. You'll need to allow traffic from the external logstash to the manager on port 5056. You can do that via SOC firewall custom port/host groups

[ColeVan]

Thank you for the response. I've tried modifying the firewall rules several different ways using the soc configuration firewall custom host/port group with no success. Is there a way to modify using ip tables or so-firewall utility manually to force the change? I've tried connecting remotely to Security Onion IP on port 5056 with no response. When I check port 5055 using telenet I'm able to get a connection just not with port 5056. I'm using a standalone setup just for context. Any help would be greatly appreciated.

[ColeVan]

Update: I was able to figure everything after a bit of troubleshooting. Essentially, it was a mix of using the right cert and modifying the right custom host/port group on then Sec Onion firewall. All the logs are coming in parsed from the remote ELK stack which is fantastic.