Serverless audit logging to Splunk and Azure Monitor
Audience: Security and platform engineering
Status: Complete for GA via Logstash workaround; native external delivery remains on the product roadmap
Requirement
Security requires all audit logging forwarded into your domain:
| Destination | Timing |
|---|---|
| Splunk | Current requirement |
| Azure Monitor / Azure Log Analytics | Future or alternate path |
Native Serverless-only audit destinations do not meet this policy for production. External delivery to customer SIEMs is a future enhancement and is not available for GA.
Decision: This requirement is complete for GA using the Logstash bridge below. Native push to Splunk / Azure Monitor stays a longer-term product ask and does not block cutover.
Recommended approach
Phase 1 — GA: Logstash bridge in your environment
Near-term path: run Logstash (or equivalent) in your network or Azure subscription.
Elastic Serverless (audit events)
│
│ Elasticsearch API over Private Link
▼
Logstash (your VPC / Azure)
│
├─► Splunk HEC (primary today)
└─► Azure Monitor / Event Hub (later)
Why Logstash:
- Runs in your domain, so audit data stays under your control
- Proven path from Elasticsearch to HTTP / HEC destinations
- Can send to Splunk now and Azure Monitor later without re-platforming Serverless
Implementation outline:
- Enable Serverless audit logging to the destinations available inside the project (source of truth).
- Deploy Logstash in Azure Central US, reachable to Serverless over Private Link.
- Input: read audit indices or data streams with a read-only API key.
- Filter: normalize to your SIEM schema; stamp project, environment, and dataset fields.
- Output A (Splunk): HTTP Event Collector — token, index, and sourcetype agreed with security.
- Output B (Azure, later): Azure Monitor Logs or Event Hubs into Log Analytics — same pipeline, second output.
- Operations: retries, lag alerting, and delivery notes for security sign-off.
Security acceptance criteria:
- All required audit event types present (authentication, authorization, config, data access as applicable)
- Freshness SLA agreed (for example under 5–15 minutes)
- Retention in Splunk or Azure matches policy
- Pipeline and credentials owned by you (or jointly operated under your IAM)
- Private networking only — no public audit egress
Phase 2 — Native external delivery
Longer term, Elastic can deliver audit events directly to customer-owned destinations (Splunk, Azure Monitor, or equivalent HTTPS endpoints). That work has non-functional requirements around authentication, reliability, and multi-tenant egress. It should not block GA if Phase 1 is accepted.
Options compared
| Option | In your domain | Ready for GA | Effort | Notes |
|---|---|---|---|---|
| A. Logstash to Splunk HEC | Yes | Yes | Medium | Preferred near-term |
| B. Logstash to Azure Monitor | Yes | Yes, when Azure path is ready | Medium | Same bridge, second output |
| C. Manual query and export scripts | Partial | Fragile | Low start, high ops | Not recommended for continuous audit |
| D. Wait for native external delivery | Yes, when shipped | No | Low customer effort, long wait | Roadmap risk if this is the only path |
| E. Serverless destinations only | No | — | — | Does not meet security policy |
Recommendation: commit to option A for GA; design the pipeline so B is a configuration change; track D as the long-term simplification.
Discussion points with security
- Audit must land in Splunk (and later Azure monitoring), not only inside Elastic Serverless.
- Native push to an external SIEM is a future enhancement — not available for GA.
- For GA, Logstash in your Azure environment pulls Serverless audit data over Private Link and forwards to Splunk HEC.
- When native external delivery ships, the bridge can be retired or reduced.
- Confirm event catalog, lag SLA, and Splunk index / sourcetype so a pilot can run before cutover.
Open questions
- Exact audit event catalog on Serverless Search versus hosted deployments.
- Roadmap timing for native external log delivery.
- Preferred Splunk path (HEC versus indexer) and Azure path (Log Analytics direct versus Event Hub).
- Who operates Logstash and who owns API key rotation.
Next steps
- Share Phase 1 architecture with security for sign-off.
- Record the external-delivery product ask with Elastic for the longer-term roadmap.
- Stand up a pilot Logstash to Splunk HEC against the Serverless project (Central US and Private Link).
- Document the runbook and lag alerts; add Azure Monitor as a second output when security is ready.