OpenSearch Monitoring Stack Deployment

Description:
I am seeking an experienced DevOps or infrastructure engineer to deploy a lightweight, three-node OpenSearch setup focused on collecting and visualizing firewall and VPN logs. This is not a full SIEM deployment. The goal is to track basic network usage trends such as bandwidth consumption and session counts.

⸻

Purpose:
The system should ingest logs from several firewalls and an OpenVPN server, and display:
• Which IPs/users are consuming the most bandwidth
• Who has the most concurrent or repeated sessions
• General outbound Internet traffic trends
• Retain logs for approximately 90 days
• Use HashiCorp Vault (already deployed) to manage secrets such as API keys, credentials, and output tokens

⸻

Infrastructure Provided:
• Three VMs (200GB disk each) with Rocky Linux or Ubuntu
• Static IPs on the same subnet
• HashiCorp Vault instance already running and accessible

⸻

Stack Requirements:
• OpenSearch (latest stable version) deployed across 3 nodes
• OpenSearch Dashboards configured
• Log collection using Filebeat or Logstash (your preference)
• Ingestion pipeline tuned for low overhead and efficient parsing
• Optional self-signed TLS setup
• Vault integration for secret storage (API tokens, Beats output credentials, etc.)

⸻

Log Sources to Ingest and Parse:
1. OpenVPN
• Show top clients by bandwidth usage and session count
2. Palo Alto PA-440 Firewall
• Track external access and top talkers
3. Cisco ASA 5506
• Monitor outbound traffic and internal usage trends
4. Check Point Firewall
• Ingest via syslog or exported raw logs

You are responsible for parsing key fields such as IP address, user ID (if available), bytes sent/received, and session metadata. Parsed data should feed cleanly into OpenSearch visualizations.