# How to Get a Raw Logs Copy from elasticsearch **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-monitoring\ **Created:** [March 5, 2021, 7:34am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326 "2021-03-05T07:34:42Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Post date:** [March 5, 2021, 7:34am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/1 "2021-03-05T07:34:42Z")
Hi Team, We are currently sending all our audit logs to elasticsearch cluster using filebeat and auditbeat ( Logstash is not used) , Can we get the raw copy of logs or some log forwarder can be used in elasticsearch to get the raw logs to another repository. This is a part of compliance requirements to store the raw logs for a period of time. Thanks, Ajesh ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [March 5, 2021, 7:57am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/2 "2021-03-05T07:57:02Z")
By default Elasticsearch already stores the raw documents as well as indexing them. You can switch that off by [disabling the `_source` field or manipulating it at index time](https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html) but assuming you haven't done that you are already storing what you need. For longer-term storage you can take [snapshots](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-restore.html) (which you can [still search](https://www.elastic.co/guide/en/elasticsearch/reference/current/searchable-snapshots.html)) and you can make a [backup](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-register-repository.html#snapshots-repository-backup) of the snapshot repository too for archival purposes. ---
**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Post date:** [March 5, 2021, 9:40am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/3 "2021-03-05T09:40:29Z")
Thanks David, will it be the same case if we use auditbeat and filebeat with ECS? Also i am not seeing any \_source fields in the discovery . How can we see these raw logs? ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/7/9759966b071a6f8002f8936b8d17afa2a0d4f362.png) Can we forward these raw logs from elasticsearch to another platform using any connector ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [March 5, 2021, 10:25am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/4 "2021-03-05T10:25:38Z")
The source is returned by default in searches, although it's not so useful to see it in the Discovery UI. Elasticsearch doesn't have a way to push logs to another system, but the other system might be able to pull them from Elasticsearch. I'm not sure why you need another system since Elasticsearch is already retaining the data you want. ---
**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Post date:** [March 8, 2021, 11:13am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/5 "2021-03-08T11:13:26Z")
Thanks David and sorry for the delay Just wanted to know how we can see/show the raw logs to compliance team. Can you please share me the location of the raw logs or how do we get it using some command from dev console. Also regarding the pulling of logs , we would like to know if we can integrate this with our Internal tool for analysis like AI/machine learning for the network logs and apache error and access logs etc. Thanks, Ajesh ---
**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\ **Post date:** [March 8, 2021, 11:32am UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/6 "2021-03-08T11:32:17Z")
> [@ajesh](#): > > Just wanted to know how we can see/show the raw logs to compliance team. Execute a search. For instance `GET /auditbeat-*/_search` will show you the `_source` for the first ten documents it finds in indices matching `auditbeat-*`. > [@ajesh](#): > > we would like to know if we can integrate this with our Internal tool As I said, Elasticsearch won't push logs to another system, but you can have your internal tool pull logs from Elasticsearch. ---
**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Post date:** [March 19, 2021, 3:11pm UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/7 "2021-03-19T15:11:42Z")
Thanks David ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 16, 2021, 3:12pm UTC](https://discuss.elastic.co/t/how-to-get-a-raw-logs-copy-from-elasticsearch/266326/8 "2021-04-16T15:12:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.