# Copying Files to Central Remote Server Using Beats/LogStash

**URL:** <https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746>\
**Category:** Logstash\
**Created:** [April 18, 2017, 4:05pm UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746 "2017-04-18T16:05:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![arpitwanchoo](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@arpitwanchoo](https://discuss.elastic.co/u/arpitwanchoo)\
**Post date:** [April 18, 2017, 4:05pm UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746/1 "2017-04-18T16:05:24Z")

</div>

Hi

I am trying to design the centralized logging structure for our org.

I was looking for a following pipeline :  
RemoteServers(FileBeat) =\> Central Server (LogStash) =\> ElasticSearch

I want FileBeat to copy files from client servers to a central repository (specific directory) and then Logstash to read from copied files instead of directly pushing data to logstash from FileBeat

I am trying to do this because I want all my log files in a central location and only filtered content will go to elastic search. There may be situations when I will use "grep" command in files on central server (where all log files are present)

So can this role of "scp" be configured by fileBeat ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 18, 2017, 10:28pm UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746/2 "2017-04-18T22:28:12Z")

</div>

Not directly.  
You'd need FB\>LS\>file.

---

<div class="post-metadata">

**Author:** ![arpitwanchoo](https://avatars.discourse-cdn.com/v4/letter/a/b3f665/32.png) [@arpitwanchoo](https://discuss.elastic.co/u/arpitwanchoo)\
**Post date:** [April 19, 2017, 3:08am UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746/3 "2017-04-19T03:08:13Z")

</div>

> [@arpitwanchoo](#):
>
> I am trying to do this because I want all my log files in a central location and only filtered content will go to Elasticsearch. There may be situations when I will use "grep" command in files on central server (where all log files are present)

So can it be that the central server is having to log stash running. The first one accepting data from file beats and creating files on disk. Wile the other one reading files from disk and pushing filtered data to Elasticsearch.

Or Is it possible to configure single log stash in a way that it accepts data from FB and writes two streams (one to disk and one to ES) ?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 19, 2017, 5:33am UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746/4 "2017-04-19T05:33:40Z")

</div>

> [@arpitwanchoo](#):
>
> Or Is it possible to configure single log stash in a way that it accepts data from FB and writes two streams (one to disk and one to ES) ?

Yes, you can do that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2017, 5:40am UTC](https://discuss.elastic.co/t/copying-files-to-central-remote-server-using-beats-logstash/82746/5 "2017-05-17T05:40:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.