# Can a winlogbeats agent be used as a relay? **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [August 19, 2021, 12:29am UTC](https://discuss.elastic.co/t/can-a-winlogbeats-agent-be-used-as-a-relay/281892 "2021-08-19T00:29:37Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![jeromeat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeromeat/32/87195_2.png) [@jeromeat](https://discuss.elastic.co/u/jeromeat)\ **Post date:** [August 19, 2021, 12:29am UTC](https://discuss.elastic.co/t/can-a-winlogbeats-agent-be-used-as-a-relay/281892/1 "2021-08-19T00:29:38Z")
Is it possible for one Windows server running Winlogbeats to forward its windows event logs to another Windows server running Winlogbeats that can then forward/relay them to elastic? I'd prefer not to go through the complexity of setting up a WEF Collector and NXlog and just use Winlogbeats if possible but I haven't found any documentation if it's possible. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 19, 2021, 12:53am UTC](https://discuss.elastic.co/t/can-a-winlogbeats-agent-be-used-as-a-relay/281892/2 "2021-08-19T00:53:46Z")
The normal pattern for this would be. Sources \> Winlogbeat (many) \> Logstash \> Elasticsearch Where Logstash acts as the collect and forward component. This is a very common architectural pattern with the elastic stack. Winlong beat is not really designed to be a collect and forward component. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 16, 2021, 2:54am UTC](https://discuss.elastic.co/t/can-a-winlogbeats-agent-be-used-as-a-relay/281892/3 "2021-09-16T02:54:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.