Simply add Elk Stack or Elasticsearch's IP address to the "Logging and Archiving" page.

Set up the server for Syslog and include an elasticsearch option and its other details and there you go.

Sending Sangfor NGAF logs to Elasticsearch or the ELK Stack is definitely doable, with several options available:

Using the Kiwi Syslog Plugin:

Official Plugin: Sangfor offers the official "Kiwi Syslog Plugin" for NGAF, specifically designed to integrate with the ELK Stack. It forwards logs formatted for Graylog2 (Sangfor's internal syslog server) to Elasticsearch.
Configuration: Configure the plugin within NGAF by specifying the Kiwi Syslog server address and port. On the ELK side, install the Graylog2 input plugin and map fields appropriately.
Directly via Logstash:

Logstash Configuration: Set up a Logstash instance on a separate server. Configure a File input to read NGAF log files (usually under /opt/Sangfor/logs). Apply Grok filters to parse the logs and extract desired fields. Finally, output the transformed data to Elasticsearch using the Elasticsearch output plugin.
Flexibility: This approach offers greater flexibility compared to the Kiwi plugin. You can customize parsing rules, enrich logs with additional data sources, and even route different log types to different ELK indexes.
Alternative Open-Source Syslog Servers:

Fluentd: Similar to Logstash, Fluentd can act as a log collector and forwarder. Configure a Fluentd agent to read NGAF logs, parse them with plugins, and send them to Elasticsearch.
rsyslog: While mainly a syslog server, rsyslog offers modules for forwarding logs to Elasticsearch. Configure rsyslog on your ELK server to collect NGAF logs via UDP or TCP with proper parsing rules.

For Security, Application Control, Traffic Audit, NAT, User Authentication, SSL VPN, Local ACL, and HA Error logs, choose Syslog as the Logging Location.
10.10.10.10 is the IP address and port number of the Syslog server.

You can add the elastic search syslog. Just go to the syslog tab and add the neccesary information in adding the syslog server. You can also contact support team.