# 24 hours logs on seprate Server **URL:** \ **Category:** Elasticsearch\ **Created:** [July 30, 2018, 5:10am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090 "2018-07-30T05:10:36Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Sulaiman](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Sulaiman](https://discuss.elastic.co/u/Sulaiman)\ **Post date:** [July 30, 2018, 5:10am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/1 "2018-07-30T05:10:36Z")
I would like to setup 2ndary elasticsearch server, where I can put only 24 hours logs and discard all others. I can't figure out how to transfer logs / indeces from one server to other while they both are on same network. I want to transfer logs in real time. Please help me in this. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 30, 2018, 6:08am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/2 "2018-07-30T06:08:13Z")
Best way is probably to index into both clusters concurrently. ---
**Author:** ![Sulaiman](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Sulaiman](https://discuss.elastic.co/u/Sulaiman)\ **Post date:** [July 30, 2018, 7:01am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/3 "2018-07-30T07:01:55Z")
Thanks for your reply, but how they both can work together, cause I don't want first elasticsearch server to share whole data with other, just oneday logs. If you have any way which can help me here will be great. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 30, 2018, 7:18am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/4 "2018-07-30T07:18:23Z")
If you want to keep data for just one day on one of the clusters you will just need to delete indices earlier there. I am not sure I understand the problem. ---
**Author:** ![Sulaiman](https://avatars.discourse-cdn.com/v4/letter/s/41988e/32.png) [@Sulaiman](https://discuss.elastic.co/u/Sulaiman)\ **Post date:** [July 30, 2018, 11:39am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/5 "2018-07-30T11:39:21Z")
Ok let me try by this way. I have a one server (WAZUH, LOGSTASH, ElasticSearch), which is primary, but I want to create another server just for logstash and elasticsearch, where I will show 24 hours of logs from wazuh. Now I have tried by rsyslog to share logs but failing. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [July 30, 2018, 11:42am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/6 "2018-07-30T11:42:28Z")
Have the first Logstash instance capture all the logs and then send it to both the local Elasticsearch instance as well as to Elasticsearch/Logstash on the other host. This means that you index the data into both clusters in parallel. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 27, 2018, 11:42am UTC](https://discuss.elastic.co/t/24-hours-logs-on-seprate-server/142090/7 "2018-08-27T11:42:33Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.