# How to filter logs on remote server before shipping to logstash server **URL:** \ **Category:** Elasticsearch\ **Created:** [November 6, 2014, 7:27pm UTC](https://discuss.elastic.co/t/how-to-filter-logs-on-remote-server-before-shipping-to-logstash-server/20616 "2014-11-06T19:27:44Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\ **Post date:** [November 6, 2014, 7:27pm UTC](https://discuss.elastic.co/t/how-to-filter-logs-on-remote-server-before-shipping-to-logstash-server/20616/1 "2014-11-06T19:27:44Z")
Hi all, I am new to ELK and my organization is interested in implementing this framework. I setup ELK on my machine and trying to collect logs from remote server. But the logs on the remote server are huge in size (in GigaBytes). I see we can use logstash shipper or logstash forwarder. But I don't want to forward all the data to central ELK server for indexing. 1. So I want to filter data on the remote servers locally before being sent to ELK server. How can we do this? Also we have many such remote servers from which I want to collect filtered logs on ELK server. 1. Can someone suggest the recommended architecture to collect 'filtered' logs from multiple remote server and forward them to central ELK server? 2. Also what could be the performance impact and CPU utilization to have logstash filtering on each remote server, Thanks, Vilas -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/f5cad331-bf0a-445c-bdfd-6ba72df7c2b3%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/f5cad331-bf0a-445c-bdfd-6ba72df7c2b3%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 10, 2014, 7:51am UTC](https://discuss.elastic.co/t/how-to-filter-logs-on-remote-server-before-shipping-to-logstash-server/20616/2 "2014-11-10T07:51:07Z")
On Thursday, November 06, 2014 at 20:27 CET, Vilas Reddy [pvilasreddy@gmail.com](mailto:pvilasreddy@gmail.com) wrote: > I am new to ELK and my organization is interested in implementing this > framework. > I setup ELK on my machine and trying to collect logs from remote > server. > But the logs on the remote server are huge in size (in GigaBytes). > I see we can use logstash shipper or logstash forwarder. But I don't > want to forward all the data to central ELK server for indexing. May I suggest you take this question to the logstash-users mailing list as it's unrelated to Elasticsearch itself. While some Logstash folks follow this list as well the message is more on-topic there. [https://groups.google.com/forum/#!forum/logstash-users](https://groups.google.com/forum/#!forum/logstash-users) [...] -- Magnus Bäck | Software Engineer, Development Tools [magnus.back@sonymobile.com](mailto:magnus.back@sonymobile.com) | Sony Mobile Communications -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/20141110075106.GC6370%40seldlx20533.corpusers.net](https://groups.google.com/d/msgid/elasticsearch/20141110075106.GC6370%40seldlx20533.corpusers.net). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\ **Post date:** [November 11, 2014, 4:55pm UTC](https://discuss.elastic.co/t/how-to-filter-logs-on-remote-server-before-shipping-to-logstash-server/20616/3 "2014-11-11T16:55:16Z")
Thanks Magnus. Submitted to the suggested logstash group. -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/fb83a0c1-6086-4af3-bd4e-6a8ff33cc1d8%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/fb83a0c1-6086-4af3-bd4e-6a8ff33cc1d8%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 12:50am UTC](https://discuss.elastic.co/t/how-to-filter-logs-on-remote-server-before-shipping-to-logstash-server/20616/4 "2017-07-06T00:50:47Z")
Closed on July 6, 2017, 12:50am UTC