# Elastic Stack as a syslog relay?

**URL:** <https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030>\
**Category:** Logstash\
**Created:** [October 6, 2017, 2:31pm UTC](https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030 "2017-10-06T14:31:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![s.essa](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@s.essa](https://discuss.elastic.co/u/s.essa)\
**Post date:** [October 6, 2017, 2:31pm UTC](https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030/1 "2017-10-06T14:31:14Z")

</div>

Hello, I am completely new to the Elastic Stack and was wondering if the following was possible:

I want to use the Elastic stack for log collection, forensics and as a relay to LogRhythm for specific use cases. I was wondering if this was possible, anybody has tried this and what problems they may have encountered.

A key requirement would be preservation of the original log, ideally we would like to forward specific logs to Logrhythm unprocessed.

Is there a way to forward logs from ELK to Logrhythm? Preferrably raw logs (preserving original source, destination, timestamp, etc).

Thanks

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 6, 2017, 9:46pm UTC](https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030/2 "2017-10-06T21:46:25Z")

</div>

I commented on your other thread as well.

But Logstash will wrap the original event in some meta fields, like time received and a few other things. So it won't be the original message being forwarded.

---

<div class="post-metadata">

**Author:** ![s.essa](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@s.essa](https://discuss.elastic.co/u/s.essa)\
**Post date:** [October 10, 2017, 1:30pm UTC](https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030/3 "2017-10-10T13:30:19Z")

</div>

Thanks for the info Mark, I'll look into the config file as well.

Is there a way to know just how each packet is changed?

Thanks again,  
Sam

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 10, 2017, 9:18pm UTC](https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030/4 "2017-10-10T21:18:33Z")

</div>

Easiest way is to push a message through with no filters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 7, 2017, 9:18pm UTC](https://discuss.elastic.co/t/elastic-stack-as-a-syslog-relay/103030/5 "2017-11-07T21:18:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.