# How to send logs to multiple UDP destination using logstash from elasticsearch

**URL:** <https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308>\
**Category:** Logstash\
**Created:** [June 29, 2021, 7:40am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308 "2021-06-29T07:40:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vedagiri\_Balaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vedagiri_balaji/32/90945_2.png) [@Vedagiri\_Balaji](https://discuss.elastic.co/u/Vedagiri_Balaji)\
**Post date:** [June 29, 2021, 7:40am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308/1 "2021-06-29T07:40:30Z")

</div>

Hi ,  
Currently we sending logs to a UDP destination, we intend send the same logs to multiple UDP destination ( logs are read from elasticsearch )

udp {  
id =\> "udp\_exporter"  
codec =\> plain {  
format =\> "%{message}"  
}  
host =\> "10.10.10.10.1"  
port =\> 522  
}

When i tried to use "host =\> "10.10.10.1, 10.10.10.2" it didn't work, it was sending logs to only first destination.

Regards,  
Balaji

---

<div class="post-metadata">

**Author:** ![pcosic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pcosic/32/90827_2.png) [@pcosic](https://discuss.elastic.co/u/pcosic)\
**Post date:** [June 29, 2021, 8:15am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308/2 "2021-06-29T08:15:44Z")

</div>

Hi,

I think this is your solution [Multiple elasticsearch clusters for output](https://discuss.elastic.co/t/multiple-elasticsearch-clusters-for-output/172503)  
So in your case try to add just another UDP output plugin

---

<div class="post-metadata">

**Author:** ![Vedagiri\_Balaji](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vedagiri_balaji/32/90945_2.png) [@Vedagiri\_Balaji](https://discuss.elastic.co/u/Vedagiri_Balaji)\
**Post date:** [June 29, 2021, 10:01am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308/3 "2021-06-29T10:01:25Z")

</div>

But my destination is not elasticsearch cluster, it is an external SIEM device.

---

<div class="post-metadata">

**Author:** ![pcosic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pcosic/32/90827_2.png) [@pcosic](https://discuss.elastic.co/u/pcosic)\
**Post date:** [June 29, 2021, 10:04am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308/4 "2021-06-29T10:04:20Z")

</div>

> [@pcosic](#):
>
> So in your case try to add just another UDP output plugin

Do you tried this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2021, 10:04am UTC](https://discuss.elastic.co/t/how-to-send-logs-to-multiple-udp-destination-using-logstash-from-elasticsearch/277308/5 "2021-07-27T10:04:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.