# Forwarding logs to external network ELK cluster
**URL:** https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432
**Category:** Elasticsearch
**Created:** [March 20, 2020, 2:27pm UTC](https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432 "2020-03-20T14:27:56Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@huntingthreats](https://discuss.elastic.co/u/huntingthreats)
#### Post date: [March 20, 2020, 2:27pm UTC](https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432/1 "2020-03-20T14:27:56Z")
Hi everyone,
I have a question about forwarding Beat data from a Customer's network to an offsite network. The idea is to get insight in the hosts data, retrieve those data with agents(Beats) and process them on a separate system within their network. Once processed, forward the data through a VPN Tunnel to the Elasticsearch cluster which will analyse the data.
I know it's really easy to set up the following situation: Hosts(auditbeat,packetbeat etc.) -\> sends data directly to Elasticsearch over the VPN. This is not ideal, this would expose the external network CIDR and ES ip-address to those hosts.
A more ideal situation would be: Hosts -\> sends data to forwarder within the same network -\> forwarder sends data to offsite ES cluster.
I know Splunk has a forwarding/collector solution for this, I'm not sure if Elastic ever thought about this situation.
Thanks!
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 20, 2020, 2:43pm UTC](https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432/2 "2020-03-20T14:43:17Z")
You can may be send the data to logstash and then ask logstash to send the data to elasticsearch?
Would that work for you?
---
### Author:  [@huntingthreats](https://discuss.elastic.co/u/huntingthreats)
#### Post date: [March 20, 2020, 2:44pm UTC](https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432/3 "2020-03-20T14:44:35Z")
That would mean we need to configure a server to run Logstash, right? Hosts will be sending their data to this specific server that reads, processes and forwards the data to an ES endpoint?
---
### Author:  [@dadoonet](https://discuss.elastic.co/u/dadoonet)
#### Post date: [March 20, 2020, 4:11pm UTC](https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432/4 "2020-03-20T16:11:14Z")
Yes.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 17, 2020, 4:11pm UTC](https://discuss.elastic.co/t/forwarding-logs-to-external-network-elk-cluster/224432/5 "2020-04-17T16:11:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.