SCOM Alerts to elasticserarch

Dashboard Server
1

Has anyone built a connector to send scom alerts to elasticsearch or a syslog system?

2 Likes
2

you can send scom alerts to OMS, which is similar to elasticsearch?

2 Likes
3

We forward alert data to Splunk which is similar. I don’t know elasticsearch, but i the splunk case we forward the events trough the splunk angent based on a PowerShell script. For each property we want to use in splunk we create Fields that splunk can read.

4

We are unable to use OMS as it go outside of our network.

5

it very similar, only different it use opensource agents or you just forward the messages as syslog. Do you have a copy of that powershell script? we might be able to tweak it for our needs.

6

Is this the solution found on Splunk website?

Are you satisfied with that?

I found some problems with it:

  • Not best practice use of SCOM cmdlets
  • Only selects on TimeAdded property (what about updates)

Or do you have another experience?