@ashok Were you able to get Osquery logging to Kafka successfully? I ran into a few issues at first, but all were related to (my limited understanding of) kafka, not OSquery. I used

kafka-console-producer.sh

and

kafka-console-consumer.sh

(Apache Kafka quickstart guide) to test and verify kafka was working correctly. Then I left

kafka-console-consumer.sh

running so I could watch the OSquery data as it came through. The OSquery config is pretty basic, this should get it working:

"logger_plugin": "kafka_producer",
"logger_kafka_broker": "node1:9092,node2:9092,node3:9092",
"logger_kafka_topic": "test",
"logger_kafka_acks": "1",

If you are still running into issues, you may want to run

tcpdump

to confirm the data is being sent to kafka correctly. You may also want to check and verify the container is able to accept the connections correctly, and use

kafka-console-producer.sh

from the node running OSquery as a full end-to-end test.