Logstash: Is it possible to forward data to other system (not opensearch) using Logstash

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch - 2.18.0

Describe the issue:
I want to read data from an OpenSearch cluster and send it to any other third party system like Splunk or ElasticSearch using Logstash. Is that possible with config change or any other modifications, please guide.

Configuration:

input {
opensearch {
hosts => [“https://HOST:PORT”]
user => “USERNAME”
password => “PASSWORD”
index => “my_index”
query => ‘{ “query”: { “match_all”: {}} }’
}
}

output {
opensearch {
hosts => [“https://HOST:PORT”]
user => “USERNAME”
password => “PASSWORD”
index => “my_index_new”
ssl => true
ecs_compatibility => “disabled”
}
}

Relevant Logs or Screenshots:

2

Hi @jmeher ,

If you add a few outputs with no condition statements, Logstash will send the input data to all outputs simultaneously. Have you tried adding one more output?

3

Hi @Eugene7 ,
Thanks for reply. I have not tried any other system yet. However, I am planning to forward the output to Splunk while retaining the logs at OpenSearch. Is this possible, any Idea?

So in my case, I want to read the logs from OpenSearch Repo and send it to any other third party external system (Open Search + Only One Third Party).

Can you please help to correct the below configurations:
innput {
opensearch {
hosts => [“[https://opensearch_host:9200]”]
index => “my_source_index”
query => ‘{ “query”: { “match_all”: {}} }’
ssl => true
ca_file => [“/user/certificate_src/CA.pem”

}
}

output {
splunk{
hosts => [“[https://sploun_host:xxxx]”]
ecs_compatibility => “disabled”
ssl => true
ca_file => "/user/certificate_src/CA.pem”
ssl_certificate => “/user/certificate_dest/client.pem”
ssl_key => “/user/certificate_dest/client.key”
}

Regards,
J Meher