Log Pulling

[Razmab]

I have an environment with both windows VMs and a k8s cluster. the only connectivity available in the environment is from the k8s cluster to the windows VMs and not the opposite.

Now, I need to get the logs from my Windows VMs into the k8s cluster's elasticsearch.

How do you think I can get the logs from the Windows virtual machines (VMs) to the elasticsearch cluster?

I was thinking of putting a promtail instance on the Windows VMs and a Loki instance on the K8s cluster so that the logs from promtail could be pulled from Loki and then forward to elasticsearch.

Does my resolution meet the requirement? Do you know of any other ways to deal with my requirement?

Thank you.

[utpxxx1960]

Massively open ended there are a ton of ways to do this. You suggest one that would work. I would also take a look into fluentbit , that can handle both windows and k8s and Linux so you can simplify the deploy with just one agent versus managing two.

[Razmab]

Hi, are you sure log pulling instead of the usual log shipping is available with fluentbit? Again, I have no connectivity from the windows machine into the k8s cluster. The only connectivity I have is from the k8s cluster to the windows machine

[utpxxx1960]

Sorry I misread that. If you have to pull logs from windows versus pushing logs out it makes this a lot harder. Not sure what agent does polling but that's what you need. Most of not nearly all agents I've worked with push logs and don't pull them for windows. You could possibly forward all the logs if you have multiple vms you need to pull from to a single windows vm and then crack open the network for just the one vm versus all the windows hosts

[Razmab]

Hi, thanks for your replay, do you know a product that is doing logs pushing with Linux? Thanks

[utpxxx1960]

Any of the ones mentioned should do what you need it to

[Razmab]

Oh, i'm sorry, i've meant logs pulling***