Ingest network logs from Existing Elasticsearch to security onion's elastic

[danilansible]

Hi Guys,

Short version : Network logs sent to Existing ES - How to Ingest these to SecOnion's ES parsed correctly so zeek or suricata can read/analyse fields properly.

setting up latest security onion 2.3.210., Standalone Mode. We've Network logs from firewalls and other devices being sent to an existing elasticsearch instance. Is it possible to ingest / forward these logs from existing ES to Security Onion's ES with proper parsing as if the logs were sent directly from devices.
Either through filebeat or logstash or what could be the better approach.

Can someone help please share ideas and direct

Sending from that existing ES would be much easy instead of configuring seconion's ip as additional target for all devices for syslogs

Many thanks in advance.

[cm-ops]

What version is your existing ES cluster?

[danilansible]

Its elasticsearch-8.5.3.

[cm-ops]

Have you looked into https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-reindex.html#reindex-from-remote?

[danilansible]

thank you so much @cm-ops for the direction.
Will take a look.