# Can Elasticsearch forward syslogs? **URL:** \ **Category:** Elasticsearch\ **Created:** [May 11, 2016, 6:10pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811 "2016-05-11T18:10:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![dkota](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dkota](https://discuss.elastic.co/u/dkota)\ **Post date:** [May 11, 2016, 6:10pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/1 "2016-05-11T18:10:38Z")
Is there a way to forward the stored data from elasticsearch in syslog format to another system? ---
**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\ **Post date:** [May 11, 2016, 8:21pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/2 "2016-05-11T20:21:53Z")
I don't think so. Anything can be done with code but at what expense and production time, an extensive text parsing could put it back together. Since Elasticsearch stores in JSON and syslog is looking for a single string. There may be a JSON to syslog tool but I am not aware of it. I would try if possible to shoot two outputs from logstash one to elasticsearch and the other to syslog server. ---
**Author:** ![dkota](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dkota](https://discuss.elastic.co/u/dkota)\ **Post date:** [May 11, 2016, 8:57pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/3 "2016-05-11T20:57:45Z")
In a rare case if we want to move away from Elasticsearch(which is being used for storing), how can we move data without data loss? Elasticsearch dump works only if you are moving from one Elasticsearch node to another? Is there a way to backup/move the data ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 11, 2016, 9:32pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/4 "2016-05-11T21:32:25Z")
You can use Logstash to do whatever you want. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 11, 2016, 10:09pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/6 "2016-05-11T22:09:18Z")
> [@MarkOStewart](#): > > There are some ways for a tribe node to export to other locations you will have to look that one up Tribe nodes do federated search across ES clusters, they do not do this ^ ---
**Author:** ![hkhalidz](https://avatars.discourse-cdn.com/v4/letter/h/dc4da7/32.png) [@hkhalidz](https://discuss.elastic.co/u/hkhalidz)\ **Post date:** [May 11, 2016, 10:12pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/7 "2016-05-11T22:12:52Z")
You can use "Logstash" for this. It can move your data to both ES and other sources. Since the output worker is a single thread, you will need to run two configuration files and use tagging on your shipper file. [Here's](http://stackoverflow.com/questions/20130864/can-logstash-process-multiple-output-simultaneously) an example that you can follow. Alternatively, you can use ES's GET API to read the data you need and write it to an output log file. This requires some scripting for reading and saving. ---
**Author:** ![MarkOStewart](https://avatars.discourse-cdn.com/v4/letter/m/898d66/32.png) [@MarkOStewart](https://discuss.elastic.co/u/MarkOStewart)\ **Post date:** [May 12, 2016, 3:39pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/8 "2016-05-12T15:39:27Z")
I stand corrected and removed post. Thanks Mark ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:52pm UTC](https://discuss.elastic.co/t/can-elasticsearch-forward-syslogs/49811/9 "2017-07-05T22:52:03Z")