Forward alerts to external elasticseach instance

[roman-werner]

Hello,

I am running T-POT in a VM. I would like to forward the alerts to another VM which is running Elasticsearch and Kibana. I was editing the "/opt/tpot/docker/elk/logstash/dist/logstash.conf" file to forward it to the other elastic search instance and restarted the docker "logstash". Without success. Any ideas?

Thanks a lot in advance.

T-Pot: 20.06
Elasticsearch: 7.15.1
Kibana: 7.15.1

[roman-werner]

https://github.com/telekom-security/tpotce/wiki/Reconfigure-logstash.conf