lvferdi
10/02/2017, 12:30 PM|1506946496.332|FAIL|186590cbd0f7#producer-1| [thrd:<http://internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com|internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com>]: <http://internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80/bootstrap|internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80/bootstrap>: Receive failed: Disconnected
If I go straight to my brokers by IP address it works without fail?????
Another issues is when/if I get osquery to ELB working where in the log do you put the SSL cert location? Of course the data should be sent encrypted.
Lastly is there a way to tell OSquery to send the logs to two different ELB’s. Say I want duplicate data sent to an east region and a west region or a region and an S3 bucket, is there a place to tell osquery to duplicate the data not just round-robin the kafka brokers?
My kafka portion of the congif:
"options": {
"config_plugin": "filesystem",
"logger_plugin": "kafka_producer",
"logger_kafka_brokers": "<http://internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80|internal-kafka-NUMBERS.us-east-1.elb.amazonaws.com:80>",
"logger_kafka_topic": "osquery",
"logger_kafka_acks": "1",
"utc": "true"
},