Curious … why have logstash inbetween whatever you're logging and Splunk?
Normally, the endpoints would either push to syslog (if they're actually pushing logs that at least resemble syslog format), and have a UF monitor the syslog collector, or the endpoints'd push HEC themselves, or you'd put a UF on each endpoint, and have them monitor whatever it is you want to monitor
May 04, 2020 at 11:37AM
via reddit https://www.reddit.com/r/Splunk/comments/gbqk3i/logstash_splunk_in_homelab_what_is_least_cpu/fpgojyp?utm_source=ifttt