Exist logs from splunk into Elastic

[tientmse62290]

From ELK version 7.17 we could retrieve log from RESTAPI
https://www.elastic.co/guide/en/observability/current/ingest-splunk.html

It would be great if we could use current log and send directly into Security Onion and process with current ingress
SO2.3.120 now use the 7.17. Hope we could have this feature in 2.3.140 if we upgrade the elastic stack

Thanks alot

[dougburks]

Looks like Elastic has marked this as Experimental. Also looks like it requires Elastic Fleet, which is currently untested and unsupported on Security Onion. It may be a few releases before the Experimentatl tag is dropped and it's fully tested.