# FTP logs - Filebeat

**URL:** <https://discuss.elastic.co/t/ftp-logs-filebeat/273430>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 19, 2021, 3:24pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430 "2021-05-19T15:24:33Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [May 19, 2021, 3:24pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/1 "2021-05-19T15:24:33Z")

</div>

Hello there,

Is there a way to set Filebeat to retrieve al the files from a folder located in a FTP server? if yes, can you please give me more information on how to configure filebeat for that?

if no, what is the alternate way to do that?

Thank you in advance!

---

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [May 19, 2021, 4:54pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/2 "2021-05-19T16:54:35Z")

</div>

Hello everyone,

I think I can do this by installing filebeat on remote server. But my logs are on z/OS LPARs. they do not have a filebeat version for z/OS.

one more question, the logs are in ebcdic-1047 encoding. do I have to convert it into plain? can anyone tell me how to convert them?

Thank you,

---

<div class="post-metadata">

**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\
**Post date:** [May 19, 2021, 9:19pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/3 "2021-05-19T21:19:19Z")

</div>

Hello! Filebeat log input support `ebcdic-1047` [encoding](: [Log input | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#_encoding_4)) with config option `encoding`. For example:

```auto
filebeat.inputs:
- type: log
  paths:
    - /var/log/vsftpd/vsftpd.log
  encoding: "ebcdic-1047"

```

---

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [May 19, 2021, 9:51pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/4 "2021-05-19T21:51:29Z")

</div>

Hello Kaiyan,

thank you for the response.

But my logs are on z/OS server. I have ftp access to these logs. how am I supposed to read these from z/OS server?

I thought I can download filebeat on z/OS and send logs to my elasticsearch but I think filebeat does not support that architecture. is there any other way?

Thanks

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 20, 2021, 3:46am UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/5 "2021-05-20T03:46:39Z")

</div>

Filebeat does not support z/OS, you will need to transfer the logs to a supported system and collect the logs from there.

Depending on how the logs are created you can build a script that will connect through ftp, get the logs and then filebeat will read it.

---

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [May 20, 2021, 12:26pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/6 "2021-05-20T12:26:56Z")

</div>

Hello Leondro,

Thank you for your response on this topic.

last question, can I do the same with Logstash? does Logstash support z/OS?

Can I do anything with Logstash in this case?

Thank you

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 20, 2021, 2:38pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/7 "2021-05-20T14:38:02Z")

</div>

None of the tools in the stack support z/OS, they support only the x86\_64 and ARM architectures running Linux, Windows or macOS.

---

<div class="post-metadata">

**Author:** ![Akhil2](https://avatars.discourse-cdn.com/v4/letter/a/8797f3/32.png) [@Akhil2](https://discuss.elastic.co/u/Akhil2)\
**Post date:** [May 20, 2021, 4:52pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/8 "2021-05-20T16:52:10Z")

</div>

Okay. Thank you Leandro!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2021, 6:52pm UTC](https://discuss.elastic.co/t/ftp-logs-filebeat/273430/9 "2021-06-17T18:52:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
