title: Pull logs from remote server into elasticsearch
body: <p>The short question is: Is it possible to pull logs (within logfiles) from a remote server and ingest them into the ELK stack.</p>
  
  <p>The long story is the following:</p>
  
  <ul>
  <li>We have a setup with a <code>DMZ</code> which is publically facing</li>
  <li>We have an <code>intranet</code> environment which hosts alot of internal systems, including the ELK stack</li>
  <li>Due to security regulations we cannot establish connections (on IP level) from the <code>DMZ</code> towards the <code>intranet</code>.</li>
  <li>We can however establish connections from the <code>intranet</code> towards the <code>DMZ</code></li>
  </ul>
  
  <p>Due to this setup, we cannot follow the normal route of installing a <code>Filebeat</code> on the server where the logs are stored and push the messages towards our <code>logstash</code> installation.</p>
  
  <p>What we would like to do is something that looks somewhat like the following:</p>
  
  <ul>
  <li>Filebeat or any other process gathers the logs on the server inside the <code>DMZ</code></li>
  <li>On this server there is some process (<code>Filebeat</code>, <code>logstash</code>, another <code>elasticsearch</code> instance?) which keeps those information in a local store</li>
  <li>This tool (whatever it might be in the end) listens on a port which is available from the <code>intranet</code></li>
  <li>Another tool inside the <code>intranet</code> connects to the <code>DMZ</code> tool and pulls all gathered logs for further processing.</li>
  </ul>
  
  <p>Our investigations sofar only resulted in solutions which push the log information to either <code>logstash</code> or <code>elasticsearch</code>.</p>
  
  <p>One thing we do not want to do is to use fileshares to make the logfiles available directly from the <code>intranet</code>.</p>
  
  <p>Our question is whether what we have in mind is possible at all and if so, what tools and with which setup we would accomplish this.</p>