# Elasticsearch has moved to new location. How to configure logstash to take it's place and forward to new location
**URL:** https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913
**Category:** Logstash
**Created:** [January 19, 2019, 9:13pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913 "2019-01-19T21:13:39Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@sejnub](https://discuss.elastic.co/u/sejnub)
#### Post date: [January 19, 2019, 9:13pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/1 "2019-01-19T21:13:40Z")
Multiple clients send there documents to the old elasticsearch location (IP). Instead of changing the config of all these clients **I want to put a logstash instance at the old ES location and let it forward all the traffic to the new elasticsearch instance**. I am sure this is possible quite easily but I don't find the exect logstash configuration I need for that.
Or am I off the track?
One reason that I do not want to change these old clients is that I can't. Some of them can't use encryption and the only way to the new location is via SSL.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 19, 2019, 9:37pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/2 "2019-01-19T21:37:21Z")
Are you going to do any processing of the message in this logstash instance? If not, why not do port forwarding using something like SSH.
---
### Author:  [@sejnub](https://discuss.elastic.co/u/sejnub)
#### Post date: [January 19, 2019, 10:15pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/3 "2019-01-19T22:15:52Z")
Thanks for your answer. Great, simple and self-evident solution.
Yes that should be possible and I will think about it. The main reason against this solution is probably my lazyness. It's easier for me to configure logstash than a VPN (or a reliable SSH tunnel).
But still and now partly just because I am curious. Do you know how to do this with logstash?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [January 19, 2019, 11:13pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/4 "2019-01-19T23:13:14Z")
If you use an http input and an http output you could probably glue them together and get the requests into elasticsearch. But you would not be able to get a response back to the client.
---
### Author:  [@sejnub](https://discuss.elastic.co/u/sejnub)
#### Post date: [January 20, 2019, 10:28pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/5 "2019-01-20T22:28:57Z")
Hmm, the longer I think about it, the more your first Idea seems the way to go. I will try it.
Thanks a lot!
---
### Author:  [@sejnub](https://discuss.elastic.co/u/sejnub)
#### Post date: [January 28, 2019, 10:55pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/6 "2019-01-28T22:55:54Z")
Yip, I did it with an SSH tunnel plus a socat process that transforms syslog UDB packets to TCP so they can be forwarded by the tunnel,
Works fine.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 25, 2019, 10:55pm UTC](https://discuss.elastic.co/t/elasticsearch-has-moved-to-new-location-how-to-configure-logstash-to-take-its-place-and-forward-to-new-location/164913/7 "2019-02-25T22:55:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.