# Filebeat Nginx Module + ModSecurity Audit Log to Same ELK Stack

**URL:** <https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 11, 2020, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018 "2020-05-11T13:11:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![adlp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adlp/32/68049_2.png) [@adlp](https://discuss.elastic.co/u/adlp)\
**Post date:** [May 11, 2020, 1:11pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018/1 "2020-05-11T13:11:24Z")

</div>

In this case I am using a droplet to host django web application. I am serving it by Nginx. Also I have integrated ModSecurity WAF with Nginx. Now I have Nginx Access & Error that I am transmitting through filebeat by enabling Nginx module to my other cloud hosted ELK server. But I also want to ship ModSecurity Audit log from this droplet to my ELK server. How can I do these simultaneously?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 11, 2020, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018/2 "2020-05-11T14:24:15Z")

</div>

Hey @adlp, welcome to discuss 🙂

You would need to add an input with the path of the ModSecurity logs, look for example to the configuration in [Filebeat to parse modsecurity json logs](https://discuss.elastic.co/t/filebeat-to-parse-modsecurity-json-logs/134662)

In the same link you can see that parsing its contents can be a more complicated task.

---

<div class="post-metadata">

**Author:** ![adlp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adlp/32/68049_2.png) [@adlp](https://discuss.elastic.co/u/adlp)\
**Post date:** [May 11, 2020, 2:32pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018/3 "2020-05-11T14:32:40Z")

</div>

Will it work when I'm already using filebeat Nginx module to ship Nginx logs? I've added input with ModSecurity Log path. But it doesn't show up in index management. I want to use Nginx module and ModSecurity log shipping together.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 11, 2020, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018/4 "2020-05-11T15:14:26Z")

</div>

AFAIK ModSecurity logs to a different file, so you need to add some input for this file. This shouldn't affect your configuration for other nginx logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2020, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-modsecurity-audit-log-to-same-elk-stack/232018/5 "2020-06-08T15:14:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.