# Establish connection to Filebeat from Logstash
**URL:** https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547
**Category:** Logstash
**Tags:** elastic-stack-security
**Created:** [June 10, 2021, 9:39am UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547 "2021-06-10T09:39:03Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)
#### Post date: [June 10, 2021, 9:39am UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/1 "2021-06-10T09:39:03Z")
Hi All,
Let's assume an application I would like to monitor is running in a Security-Network-Zone (e.g. DMZ). It should be integrated via Filebeat into the Logstash & Elasticsearch platform running in the internal network zone.
But unfortunately the Security-Zone does not allow me to establish a connection to the internal network for security-reasons. It is only allowed, to create a connection from the internal network to the security-zone.
As the connection between Filebeat & Logstash is persistent anyway, I was thinking if there is a way to initialize the connection to Filebeat from Logstash (Internal to DMZ)? But it seems not, as I haven't found any information.
What would be your advice in that architecture to solve this requirement?
Many thanks in advance!
Chris
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 10, 2021, 2:59pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/2 "2021-06-10T14:59:20Z")
You might be able to do it by using a tunnel created using a port forwarder.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [June 10, 2021, 3:29pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/3 "2021-06-10T15:29:13Z")
Can you add any other tools in the DMZ infrastructure? If so you could use Kafka.
You would need to configure your Filebeat (in the DMZ) to ship the logs to Kafka (also in the DMZ), then you would use the kafka input in logstash to pull the logs from Kafka.
This way it is your logstash server that will start the connection.
---
### Author:  [@cwiechmann](https://discuss.elastic.co/u/cwiechmann)
#### Post date: [June 16, 2021, 7:06pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/4 "2021-06-16T19:06:00Z")
What you guys think about the option to use Logstash in Server-Mode in the DMZ-Zone?
```auto
input {
file { .... }
}
filter { ... }
output {
tcp {
port => 5044
host => "0.0.0.0"
mode => "server"
}
}
```
And on the internal Logstash:
```auto
input {
tcp {
port => 5044
host => "10.58.143.112"
mode => "client"
}
}
filter { ... }
output { ... To Elasticsearch ... }
```
Thanks!
Chris
---
### Author:  [@Iker](https://discuss.elastic.co/u/Iker)
#### Post date: [June 16, 2021, 7:14pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/5 "2021-06-16T19:14:39Z")
Indeed the Security Advice will not be to forward the logs to the internal zone, but implement a logs concentrator in the DMZ, in this case I think another logstash instance is the way to go.
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 16, 2021, 8:29pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/6 "2021-06-16T20:29:18Z")
> [@cwiechmann](#):
>
> What you guys think about the option to use Logstash in Server-Mode in the DMZ-Zone?
It is an interesting suggestion. You would need to test what happens when each one restarts, what happens when each one starts when the other is not running etc. (If I recall correctly the output will hang in the register function until it connects.)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 14, 2021, 8:30pm UTC](https://discuss.elastic.co/t/establish-connection-to-filebeat-from-logstash/275547/7 "2021-07-14T20:30:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.