# Building a Syslog Infrastructure **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2016, 10:24am UTC](https://discuss.elastic.co/t/building-a-syslog-infrastructure/57089 "2016-08-03T10:24:45Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\ **Post date:** [August 3, 2016, 10:24am UTC](https://discuss.elastic.co/t/building-a-syslog-infrastructure/57089/1 "2016-08-03T10:24:45Z")
Hello together, we want to build a scalable Syslog Infrastructure with the ELK Stack. We have some branch Offices and one head Office. We would like only collect the syslog data in the branch offices and send them over an already standing vpn tunnel to the head office. If the vpn tunnel is down because the Internet Connection is broken the syslog instance in the branch office should buffer it till the internet connection and vpn tunnel is again standing. The head office should accept the collected syslog data from the branch offices and should give it to elasticsearch. Kibana should finally visualize the data. Can anyone tell me which instances (filebeat, logstash shipper, logstash forwarder ..) in which sequence i need for that? Best Regards Daniel ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 5, 2016, 12:17am UTC](https://discuss.elastic.co/t/building-a-syslog-infrastructure/57089/2 "2016-08-05T00:17:06Z")
You probably want filebeats on the hosts that are generating logs, they then push into a broker. In the head office you can then have LS puling data from those brokers and pushing into ES. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:44am UTC](https://discuss.elastic.co/t/building-a-syslog-infrastructure/57089/3 "2017-07-06T04:44:46Z")