# Forward syslogs to another siem **URL:** \ **Category:** Logstash\ **Created:** [March 19, 2019, 7:49pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045 "2019-03-19T19:49:37Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![bambam](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@bambam](https://discuss.elastic.co/u/bambam)\ **Post date:** [March 19, 2019, 7:49pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/1 "2019-03-19T19:49:38Z")
I have several machines that use filebeats to send syslog messages to the SIEM. I'd like to send these logs to another external machine besides the local machine. How can I do this? ---
**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Post date:** [March 19, 2019, 8:54pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/2 "2019-03-19T20:54:19Z")
Hi, Editing each /etc/filebeat/filebeat.yml And enabling (or adding if it is not already there, commented) the new output. Take a look at this to the supported outputs. [https://www.elastic.co/guide/en/beats/filebeat/current/configuring-output.html](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-output.html) ---
**Author:** ![bambam](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@bambam](https://discuss.elastic.co/u/bambam)\ **Post date:** [March 21, 2019, 11:13am UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/3 "2019-03-21T11:13:23Z")
I currently have all Windows devices, network switches, etc..., sending logs to one Linux machine that Elastic Stack installed. What I'd like to do is forward all the logs collected in logstash to another external siem. ---
**Author:** ![pup\_seba](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pup_seba/32/42988_2.png) [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Post date:** [March 21, 2019, 11:27am UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/4 "2019-03-21T11:27:08Z")
Hi, So you just need to enable another output in your logstash.yml file and add the information for your "another external siem". Take a look at this to see the supported outputs: [https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html) ---
**Author:** ![leo\_ponton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leo_ponton/32/42491_2.png) [@leo\_ponton](https://discuss.elastic.co/u/leo_ponton)\ **Post date:** [March 21, 2019, 2:57pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/5 "2019-03-21T14:57:32Z")
If you cannot configure the individual devices to send to multiple logging endpoints, you could try using samplicator (if the syslogs are UDP): [https://github.com/sleinen/samplicator](https://github.com/sleinen/samplicator) It's easy to set up and works well. ---
**Author:** ![bambam](https://avatars.discourse-cdn.com/v4/letter/b/9d8465/32.png) [@bambam](https://discuss.elastic.co/u/bambam)\ **Post date:** [March 21, 2019, 3:47pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/6 "2019-03-21T15:47:50Z")
I'm very new to how this works so please excuse my confusion. In my /etc/logstash/conf.d/ folder I have the following files: logstash-beats.conf logstash-fwd-alarm.conf logstash-output.conf logstash-snmptrap.conf logstash-syslog.conf Which one of these files would I have to modify in order to forward all syslog messages and winlogbeat to two different IP addresses? ---
**Author:** ![leo\_ponton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leo_ponton/32/42491_2.png) [@leo\_ponton](https://discuss.elastic.co/u/leo_ponton)\ **Post date:** [March 21, 2019, 4:29pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/7 "2019-03-21T16:29:28Z")
I would duplicate them at source. I don't know whether your second SIEM is elastic stack or something else, so I'm talking about duplicating raw logs. Even if they are both elastic stack, it will be more resilient to log independently. For winlogbeat you will need to copy the service and edit it to rename it so that two instances of winlogbeat will run. My understanding is that beats will select the first available endpoint from whatever list you configure rather than log to both. I'm not a Windows person so can't help you with that service config, but there's plenty help out there. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 18, 2019, 4:29pm UTC](https://discuss.elastic.co/t/forward-syslogs-to-another-siem/173045/8 "2019-04-18T16:29:31Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.