# A middle logstash

**URL:** <https://discuss.elastic.co/t/a-middle-logstash/39980>\
**Category:** Logstash\
**Created:** [January 25, 2016, 12:05am UTC](https://discuss.elastic.co/t/a-middle-logstash/39980 "2016-01-25T00:05:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bw57899](https://avatars.discourse-cdn.com/v4/letter/b/b782af/32.png) [@bw57899](https://discuss.elastic.co/u/bw57899)\
**Post date:** [January 25, 2016, 12:05am UTC](https://discuss.elastic.co/t/a-middle-logstash/39980/1 "2016-01-25T00:05:49Z")

</div>

We currently have an managed services running on cloud which is not in our control. The application can export log via Logstash forwarder or Fluentd.

I need set a middleware in company network to receive these logs, filter the logs (most for security check), then forward to my company's logstash server.

So how to design the middleware? it will work as a proxy. My understand is, it need be a logstash shipper, but how to make it work together?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [January 25, 2016, 7:05am UTC](https://discuss.elastic.co/t/a-middle-logstash/39980/2 "2016-01-25T07:05:43Z")

</div>

Set up a Logstash instance with an input that supports whatever protocol the log shipper in the cloud supports (in the logstash-forwarder case you should use the lumberjack input, or even better replace LSF with Filebeat and use the beats input). Include whatever filters you need and a lumberjack output that connects to the lumberjack input of your main Logstash server(s).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:14am UTC](https://discuss.elastic.co/t/a-middle-logstash/39980/3 "2017-07-06T05:14:33Z")

</div>

Closed on July 6, 2017, 5:14am UTC


