Linking RSA with Logstash etc

Question

I was wondering whether we can use logstash or any other open source or free log management tool to collect and index the data and then feed this index into RSA envision or any other enterprise SIEM tool.

Will this be beneficial in any way?

Also are the indexes of various Log Management and SIEM tools -- (Splunk, RSA envision, HP Arcsight Logger, Logstash etc.) compatible with each other?

My organization is planning to buy RSA envision appliance and is there any way to restrict or select only certain types of log files (eg: security logs or Apache logs) so that only those are monitored and this will reduce the EPS (events per second)?

Answer 1

Indexes are specific to the SIEM tools depends upon the DB they are using in the back end and the database schema system they use. So, the indexes cant be compatible each other. The point to be considered is whether this index can be customized based on the customer needs or not? or will the SIEM allows indexing multiple fields (Ex: username, source IP, dest IP etc)

All the SIEMs are providing the way to select only required log types.