# How to query logstash for all incoming or outgoing records **URL:** \ **Category:** Logstash\ **Created:** [July 21, 2020, 7:40am UTC](https://discuss.elastic.co/t/how-to-query-logstash-for-all-incoming-or-outgoing-records/241977 "2020-07-21T07:40:37Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![rustyweise](https://avatars.discourse-cdn.com/v4/letter/r/aca169/32.png) [@rustyweise](https://discuss.elastic.co/u/rustyweise)\ **Post date:** [July 21, 2020, 7:40am UTC](https://discuss.elastic.co/t/how-to-query-logstash-for-all-incoming-or-outgoing-records/241977/1 "2020-07-21T07:40:37Z")
We are using logstash as a proxy between beats, syslog, fluentbit, etc and [logz.io](http://logz.io). I would like to inspect ('tee') the input stream, specifically from a vCSA syslog stream, or query logstash for in-memory records, or ('tee') the output stream which is being shipped to [logz.io](http://logz.io). The challenge is that this is a production VM, tcpdump or other utilities are not installed, and I cannot stop/reconfigure logstash. Is there any API or other means to inspect the data stream input or output while not impacting production? I realize that, if this was possible, this could be a significant security concern though I'm already on the node which is running logstash so I hoped there was some form of internal monitoring mechanism. I know of the logstash api listening on port 9600, but it appears to be more stats on the running service. Thank you for your time _bow_ ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 18, 2020, 7:41am UTC](https://discuss.elastic.co/t/how-to-query-logstash-for-all-incoming-or-outgoing-records/241977/2 "2020-08-18T07:41:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.