I am collecting logs with FileBeat to Logstash in ELK stack but some systems are running in DMZ behind a firewall and I am interested in reducing firewall rules to add/manage.
After reading following documentations:
I am aware it is possible to collect and forward with logstash itself, and eventually thanks to queuing products like Kafka.
Looking for a lighter solution, as I am only interested in beats forwarding, I have found following tools:
This option allows me to open a single network connection from a beats forwarder system in DMZ to ELK.
To follow security guidelines, I would like to avoid incoming connection from DMZ and so now looking for a way to get Logstash pull beats from a (simple) beats queue/spool system running in DMZ.
Is there any existing option? What would you recommend?