# How to send Custom Logs Agent to Logstash?

**URL:** https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065
**Category:** Logstash
**Tags:** fleet
**Created:** [December 28, 2021, 7:07pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065 "2021-12-28T19:07:47Z")
**Posts on this page:** 10
**Page:** 1

<div class="post-metadata">

### Author: ![dannie-ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dannie-ml/32/99559_2.png) [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [December 28, 2021, 7:07pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/1 "2021-12-28T19:07:47Z")

</div>

Hi, i integrate it an elastics agent 'custom logs' and in the logs section this is the stream

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e8b60ca934c94a73be6fcefc1e1ed1244a2fa38.png)

Now i want to parse some information in logstash, ¿how i can send that data to logstash?  
Please provide me a detail explanation because im kind of new.  
I was wondering an approach for the standalone configuration but im not sure at all

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [December 28, 2021, 7:13pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/2 "2021-12-28T19:13:24Z")

</div>

You can configure your stand-alone Elastic Agent with a [Logstash Output](https://www.elastic.co/guide/en/fleet/master/logstash-output.html) to route events to Logstash, and then configure your Logstash pipeline to route the events to Elasticsearch as a data\_stream.

---

<div class="post-metadata">

### Author: ![dannie-ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dannie-ml/32/99559_2.png) [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [December 28, 2021, 7:22pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/3 "2021-12-28T19:22:12Z")

</div>

So basically is chnage this fleet configuration in the elastic-agent.yml?

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/d/fdd7ed3b66c90fe4bd5ae0b85be9f36fa0fc566c.png)

I dont really know what to write in the field of use outputs , the documentations seems a little confuse to me

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [December 28, 2021, 7:28pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/4 "2021-12-28T19:28:52Z")

</div>

Ah. Within Fleet. I'm not sure that is supported.

> The Logstash output is currently only supported for Elastic Agents in standalone mode. Fleet-managed agents are not supported.  
> [-- Elastic Agent: Logstash Output](https://www.elastic.co/guide/en/fleet/master/logstash-output.html)

You could spin up a Logstash instance that reads from your Elasticsearch datastream, processes the data, and outputs it to a _new_ datastream.

What are you attempting to accomplish by adding Logstash to the mix?

---

<div class="post-metadata">

### Author: ![dannie-ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dannie-ml/32/99559_2.png) [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [December 28, 2021, 7:39pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/5 "2021-12-28T19:39:09Z")

</div>

> [@yaauie](#):
>
> You could spin up a Logstash instance that reads from your Elasticsearch datastream, processes the data, and outputs it to a _new_ datastream.

That is what i want. I've done an integration with an elastic agent but now i don't know how to spin up a logstash instance that reads that data stream, i dont know how to send that data stream to logstash. My data stream is the attached image in the post.  
And that's what i want to attemp, send my data stream to process the data.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1098f92c9b6c2ad92f8dacb48acd24c6dd8c655.png)  
The generic dataset is generated by the agent 'custom logs'

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [December 28, 2021, 7:45pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/6 "2021-12-28T19:45:13Z")

</div>

I haven't done this, but my best guess would be to use the [Elasticsearch input plugin for Logstash](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html) with a query designed to fetch recent data from a wildcard-pattern index matching your datastream.

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [December 28, 2021, 7:48pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/7 "2021-12-28T19:48:19Z")

</div>

Alternatively, you may want to look into using an [Elasticsearch Ingest Pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) to process the data _before_ it is put into the datastream.

---

<div class="post-metadata">

### Author: ![dannie-ml](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dannie-ml/32/99559_2.png) [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [December 28, 2021, 7:55pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/8 "2021-12-28T19:55:09Z")

</div>

Do you think that following the documentation of [Logstash output | Fleet and Elastic Agent Guide [7.16] | Elastic](https://www.elastic.co/guide/en/fleet/7.16/logstash-output.html)  
Could it work for my purpose?

---

<div class="post-metadata">

### Author: ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)
#### Post date: [December 28, 2021, 7:59pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/9 "2021-12-28T19:59:32Z")

</div>

That is the documentation for Agent that I linked you to earlier. It claims at the top that it does _not_ work with Fleet-managed Agents, and only works with Agent in stand-alone mode. YOu have indicated that you are using Fleet to manage your agents, so I don't believe it will work.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 25, 2022, 8:00pm UTC](https://discuss.elastic.co/t/how-to-send-custom-logs-agent-to-logstash/293065/10 "2022-01-25T20:00:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
