# Forwarding logs from logstashA to LogstashB to Kibana **URL:** \ **Category:** Logstash\ **Created:** [January 4, 2017, 8:32pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609 "2017-01-04T20:32:54Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Maria\_Delarosa](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Post date:** [January 4, 2017, 8:32pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/1 "2017-01-04T20:32:54Z")
I am currently trying to implement my own "logstash-forwarder". I am running this from a local windows machine and I am succefully able to send logs from one logstash instance to Kibana. However, I would like to be able to send logs from logstashA, logstashB, etc. to logStashMaster and then finally forward the data over to kibana. Afer reading [this](https://discuss.elastic.co/t/output-from-logstash-a-into-input-of-logstash-b-over-tcp/29161), I see that it is possible to achieve with the `tcp` option in the configuration file. However, when I check in Kibana I dont see any logs. How can I make this work? I am running several instances of logstash and testing this all in one local machine. Ideal: `logstashA -> logstashMaster -> Kibana` > logstashA.conf ``` input { file { path => "C:/Users/Mary/mylogs.log" start_position => "beginning" } } output { tcp { host => "127.0.0.1" port => 9389 } } ``` > logstashMaster.conf ``` input { tcp { port => 9389 } } output { kafka { codec => plain bootstrap_servers => "remoteserver.com:9093" } } ``` References: [TCP](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-tcp.html) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2017, 12:11am UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/2 "2017-01-05T00:11:48Z")
> [@Maria\_Delarosa](#): > > output { > tcp { > host =\> "127.0.0.1" > port =\> 9689 > } > } Does not match [quote="Maria\_Delarosa, post:1, topic:70609"] input { tcp { port =\> 9389 } } [/quote] ---
**Author:** ![Maria\_Delarosa](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Post date:** [January 5, 2017, 3:56pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/3 "2017-01-05T15:56:04Z")
Hi, thanks for the response. I corrected the port number typo. I am still not getting any logs sent. what is the proper/correct way to have one instance of logstash talk to another? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2017, 8:51pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/4 "2017-01-05T20:51:46Z")
Add a stdout section to each output to make sure it is actually processing things as expected. ---
**Author:** ![Maria\_Delarosa](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Post date:** [January 5, 2017, 8:55pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/5 "2017-01-05T20:55:13Z")
I placed stdout {} in the output and it is processing it correctly. It seems that the issue is Kibana. I am not able to view it in Kibana. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2017, 9:00pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/6 "2017-01-05T21:00:59Z")
Is there data in ES? Use the `_cat` APIs to check. ---
**Author:** ![Maria\_Delarosa](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Post date:** [January 5, 2017, 10:57pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/7 "2017-01-05T22:57:05Z")
There seems to be old data but nothing recent. How do I use the `_cat` APIs ? I read a bit about it but unsure how to related to my scenario [https://www.elastic.co/guide/en/elasticsearch/reference/current/cat.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat.html) ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 5, 2017, 11:07pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/8 "2017-01-05T23:07:43Z")
Well you can call `_cat/indices` for example, to see what indexes are created, thereby confirming if data is making it to ES. ---
**Author:** ![Maria\_Delarosa](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Post date:** [January 6, 2017, 3:13pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/9 "2017-01-06T15:13:37Z")
Thanks, I was able to call the `_cat` API properly. However, no data is being sent. Have you been able to get it to work on your end? Not sure what I am doing wrong. Everything seems to be in place as shown above. ---
**Author:** ![Maria\_Delarosa](https://avatars.discourse-cdn.com/v4/letter/m/87869e/32.png) [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Post date:** [January 6, 2017, 3:53pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/10 "2017-01-06T15:53:24Z")
When I kill the instance of LogstashA, it finally forwards it to LogstashB. Why such behavior? I am doing this all from the same localmachine. Could that be the issue? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 3, 2017, 3:53pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609/11 "2017-02-03T15:53:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.