# Forward logstash logs to another SIEM

**URL:** https://discuss.elastic.co/t/forward-logstash-logs-to-another-siem/370959
**Category:** Logstash
**Tags:** elastic-stack-alerting
**Created:** [November 22, 2024, 2:05pm UTC](https://discuss.elastic.co/t/forward-logstash-logs-to-another-siem/370959 "2024-11-22T14:05:06Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Bantou0](https://avatars.discourse-cdn.com/v4/letter/b/bc79bd/32.png) [@Bantou0](https://discuss.elastic.co/u/Bantou0)
#### Post date: [November 22, 2024, 2:05pm UTC](https://discuss.elastic.co/t/forward-logstash-logs-to-another-siem/370959/1 "2024-11-22T14:05:06Z")

</div>

Hi everyone,

I am facing issues with our new servers which can only have one syslog server configured. We are using two SIEM to send logs (logstash and FSIEM). So I would like to configure the logstash virtual IP as the only one syslog server and forward logs from logstash configuration to other SIEM.  
Is there a way to do that ? if someone can help please !

Here my logstash configuration. /var/lib/logstash/pipeline/logstash.conf

```auto
input {
    udp {
        port => 5514
        type => syslog
    }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
     date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
     }
   }
}

output {
  elasticsearch {
    hosts => "<ip_address>:9200"
    user => "<user>"
    password => "<password>"
    index => "<prefix>-%{host}_logstash_%{+YYYY.MM}"
  }
}

```

Thanks in advance for your help

Regards,  
Cheikh

---

<div class="post-metadata">

### Author: ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [November 22, 2024, 2:32pm UTC](https://discuss.elastic.co/t/forward-logstash-logs-to-another-siem/370959/2 "2024-11-22T14:32:04Z")

</div>

You can define two outputs in a logstash pipeline so you'll just add another output block.

This has a number of downsides you'll want to consider, for example, the pipeline may stop processing syslog messages if an output becomes unavailable.

---

<div class="post-metadata">

### Author: ![Bantou0](https://avatars.discourse-cdn.com/v4/letter/b/bc79bd/32.png) [@Bantou0](https://discuss.elastic.co/u/Bantou0)
#### Post date: [November 22, 2024, 2:52pm UTC](https://discuss.elastic.co/t/forward-logstash-logs-to-another-siem/370959/3 "2024-11-22T14:52:57Z")

</div>

Hello William,

Thanks a lot for your quick feedback.  
I already install the syslog plugin

```auto
# podman exex -it logstash /bin/bash
logstash$ bin/logstash-plugin install logstash-output-syslog

```

I am now trying this following

```auto
input {
    udp {
        port => 5514
        type => syslog
    }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
     date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
     }
   }
}

output {
  elasticsearch {
    hosts => "<elastic_server_address>:9200"
    user => "<user>"
    password => "<password>"
    index => "<prefix>-%{host}_logstash_%{+YYYY.MM}"
  }
  syslog {
    appname => "FortiSIEM"
    protocol => "udp"
    port => "514"
    host => "<fsiem_server_address>"
    rfc => "rfc3164"
  }
}

```

I will give you feedback if it is working fine or not.

Thanks again !  
Cheers