# How to send different logs to logstash and elasticsearch

**URL:** <https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 12, 2021, 6:13am UTC](https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038 "2021-03-12T06:13:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![its-ogawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/its-ogawa/32/120829_2.png) [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Post date:** [March 12, 2021, 6:13am UTC](https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038/1 "2021-03-12T06:13:00Z")

</div>

It turns out that filebeat.yml can send the output to elasticsearch or logstash.

Is it possible to change the destination depending on the logs collected by filebeat?  
For example, is it possible to send general logs that can be configured in modules (ex. syslog, nginx) directly to elasticsearch, while original logs are sent to logstash, adjusted by filter, and then sent to elasticsearch?

---

<div class="post-metadata">

**Author:** ![its-ogawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/its-ogawa/32/120829_2.png) [@its-ogawa](https://discuss.elastic.co/u/its-ogawa)\
**Post date:** [March 12, 2021, 8:04am UTC](https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038/2 "2021-03-12T08:04:30Z")

</div>

Should I send everything, including the module, to logstash?  
The concern with sending everything to logstash is that the logstash configuration file will be complicated to write.  
If filebeat can parse the modules into the appropriate fields and send them to elasticsearch, I would prefer that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2021, 10:05am UTC](https://discuss.elastic.co/t/how-to-send-different-logs-to-logstash-and-elasticsearch/267038/3 "2021-04-09T10:05:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.