# Filebeat installation question? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 6, 2020, 1:51pm UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140 "2020-10-06T13:51:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pacy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacy1/32/76910_2.png) [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Post date:** [October 6, 2020, 1:51pm UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/1 "2020-10-06T13:51:10Z")
1. where to install filebeat, after i finish to installing elsticsearch ,logstash and kibana. 2. how to configure logstash to use log file downloaded. Kindly assist me on this, Thank you in advance ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [October 6, 2020, 11:41pm UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/2 "2020-10-06T23:41:53Z")
Hello! You can run Filebeat locally or wherever your Elasticsearch/Kibana is. Maybe this will help 🙂 [https://www.elastic.co/guide/en/logstash/current/first-event.html#first-event](https://www.elastic.co/guide/en/logstash/current/first-event.html#first-event) [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html) ---
**Author:** ![pacy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacy1/32/76910_2.png) [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Post date:** [October 7, 2020, 5:00am UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/3 "2020-10-07T05:00:12Z")
Thank you kaiyan for your assistance, I still having some confused on how to configure logstash, i want to configure in way it will parse this kind of event; having these fields; src\_ip=x.x.x.x dest\_ip=x.x.x.x dest\_port=x signature= (like DOS\_udp ) or signature=(like http\_put\_method) action=allowed or action=blocked host= device\_ip count=x host\_name= x\_name time=yyyy-mm-dd hh-mm-ss how can i configure this, This is a syslog and how can configure the syslog sender to forward logs into logstash,as this syslog sender not enabling filebeat to be installed on that syslog sender it doesn't have an OS on it. I need help on this Thank you in advance ---
**Author:** ![borna\_talebi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/borna_talebi/32/76317_2.png) [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)\ **Post date:** [October 7, 2020, 5:17am UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/4 "2020-10-07T05:17:57Z")
Hi paci, > syslog sender not enabling filebeat to be installed on that syslog sender it doesn't have an OS on it. You can tell the syslog sender to forward logs to another machine that has filebeat(or logstash) installed on it. Could you tell us what kind of device is your syslog sender? ---
**Author:** ![pacy1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pacy1/32/76910_2.png) [@pacy1](https://discuss.elastic.co/u/pacy1)\ **Post date:** [October 7, 2020, 5:28am UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/5 "2020-10-07T05:28:06Z")
Thank you dear Borna, for your prompt response @This is a network device Intrusion Prevention system, But still i don't know how to do configuration on the logstash to parse the logs like it is done in Grok debugger, i have mentioned in the above how my logs looks and i want to extract them by fetching the above information from the raw events, How can i do that? So far i have installed elasticsearch ,kibana and logstash, but configuration in logstash that is where i got stuck, help me with your guidance at this step Thank you. ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [October 7, 2020, 10:15pm UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/6 "2020-10-07T22:15:40Z")
Hi @pacy1, you will probably get more help about logstash in logstash forum: [https://discuss.elastic.co/c/elastic-stack/logstash](https://discuss.elastic.co/c/elastic-stack/logstash) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2020, 10:15pm UTC](https://discuss.elastic.co/t/filebeat-installation-question/251140/7 "2020-11-04T22:15:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.