# Can logstash write out the log files passed from filebeat?

**URL:** <https://discuss.elastic.co/t/can-logstash-write-out-the-log-files-passed-from-filebeat/140949>\
**Category:** Logstash\
**Created:** [July 20, 2018, 5:21pm UTC](https://discuss.elastic.co/t/can-logstash-write-out-the-log-files-passed-from-filebeat/140949 "2018-07-20T17:21:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cholden14](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@cholden14](https://discuss.elastic.co/u/cholden14)\
**Post date:** [July 20, 2018, 5:21pm UTC](https://discuss.elastic.co/t/can-logstash-write-out-the-log-files-passed-from-filebeat/140949/1 "2018-07-20T17:21:35Z")

</div>

Due to some regulator requirements we have to backup log files from our applications. I am lookin to having filebeat ship the logs to logstash and was hoping logstash would write out the logfiles to the server so we can then back them up.

Is that possible and I am just missing the setup magic?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [July 20, 2018, 5:44pm UTC](https://discuss.elastic.co/t/can-logstash-write-out-the-log-files-passed-from-filebeat/140949/2 "2018-07-20T17:44:16Z")

</div>

You can do that with a file output, e.g. like this:

```nohighlight
file {
  path => "/path/to/logfile.log"
  codec => plain {
    format => "%{message}"
  }
}

```

Depending on the kind of processing you're doing in your filters you may have to use a clone filter to split each input event in two, one that isn't filtered and just reaches your file output and one with the usual set of filters.

The path to the output file can be set dynamically so that you can write to a file named like the original logfile (prefixed by the hostname e.g.). See [https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html](https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 17, 2018, 5:44pm UTC](https://discuss.elastic.co/t/can-logstash-write-out-the-log-files-passed-from-filebeat/140949/3 "2018-08-17T17:44:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.