How to deliver DNS log from Route 53 to on-premises ELK

Question

Hi guys!
I receive a requirement that needs to deliver public DNS query log from Route 53 to their existing ELK (Elasticsearch, Logstash, Kibana) located in on-premises. Although I recommended that they use CloudWatch Log, OpenSearch in AWS but they insist on leveraging their existing ELK, so I have to find solution to meet this requirement.
If you know the answer, please help me.
Thanks!

Accepted Answer

You could configure your Route53 logs to be sent to a [Kinesis Data Firehose](https://aws.amazon.com/kinesis/data-firehose/) delivery stream, with the destination of the stream set to your ELK setup. Since you have an on-prem ELK, you would have to use an HTTP endpoint to receive this data - https://docs.aws.amazon.com/firehose/latest/dev/create-destination.html#create-destination-http

How to deliver DNS log from Route 53 to on-premises ELK

Contenido relevante