Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy

Ingest model

Data path: Elastic Agent to Logstash as bridge to Elasticsearch on Elastic Stack network
Control path: Elastic Agent to Fleet Server to {es}

Use when

Agents have network restrictions for connecting to Elasticsearch on Elastic Stack deployed outside of the agent network

Example

You can send data from multiple Elastic Agents through your demilitarized zone (DMZ) to Logstash, and then use Logstash as a proxy through your firewall to Elasticsearch Service. This approach helps reduce the number of firewall exceptions needed to forward data from large numbers of Elastic Agents.

Resources

Info on configuring Elastic Agent:

• Fleet and Elastic Agent Guide
• Configuring outputs for Elastic Agent

Info on Logstash and Logstash plugins:

• Logstash Reference
• Elasticsearch output plugin

Info on Elasticsearch:

• Elasticsearch Guide