# How to format/filter events from syslog to send to auditbeat index **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [August 1, 2019, 9:40am UTC](https://discuss.elastic.co/t/how-to-format-filter-events-from-syslog-to-send-to-auditbeat-index/193287 "2019-08-01T09:40:53Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![MalfuncEddie](https://avatars.discourse-cdn.com/v4/letter/m/3da27b/32.png) [@MalfuncEddie](https://discuss.elastic.co/u/MalfuncEddie)\ **Post date:** [August 1, 2019, 9:40am UTC](https://discuss.elastic.co/t/how-to-format-filter-events-from-syslog-to-send-to-auditbeat-index/193287/1 "2019-08-01T09:40:53Z")
Hi, Audit beat is not supported on AIX. But I can send auth information to an syslog server. I would like to write a filter that can send the syslog file to the audit beat index. Is there any guide how to do this? kind regards ---
**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\ **Post date:** [August 1, 2019, 12:56pm UTC](https://discuss.elastic.co/t/how-to-format-filter-events-from-syslog-to-send-to-auditbeat-index/193287/2 "2019-08-01T12:56:13Z")
You would usually send Syslog to the Filebeat index. Filebeat has a [Syslog input](https://www.elastic.co/guide/en/beats/filebeat/7.3/filebeat-input-syslog.html) that you could use. Or, if you have your Syslog server write to log files on disk, you can use Filebeat with the [Log input](https://www.elastic.co/guide/en/beats/filebeat/7.3/filebeat-input-log.html). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 22, 2019, 1:01pm UTC](https://discuss.elastic.co/t/how-to-format-filter-events-from-syslog-to-send-to-auditbeat-index/193287/3 "2019-08-22T13:01:23Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.