Hi All, I’ve been trying to run Fleet without sending data to a 3rd party ingest, but now recognise the need to do this. A number of these tools are mentioned on the web page, but only a couple are specifically described in the docs.
For instance- how do we export to Elastic?
Is there any documentation for this please?
08/12/2022, 3:48 PM
The ones described in the docs (Firehose, Snowflake, Splunk, Kinesis, Lambda, PubSub, and Kafka) are all configured using Fleet configuration options. For other logging destinations, you can set up Filesystem logging and then use a log shipper to send them pretty much wherever you want.
In the DEFCON workshop yesterday, @Guillaume and I used Filebeat and I found it pretty easy to work with.