# How to use send query instead of elastic to logstash?

**URL:** https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842
**Category:** Logstash
**Created:** [October 31, 2018, 12:34pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842 "2018-10-31T12:34:30Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![mhsankar](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@mhsankar](https://discuss.elastic.co/u/mhsankar)
#### Post date: [October 31, 2018, 12:34pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/1 "2018-10-31T12:34:30Z")

</div>

Hi  
How can send my query instead of elastic to logstash?  
i want to use logstash to get my query from elastic.  
how can i use it?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 31, 2018, 12:38pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/2 "2018-10-31T12:38:32Z")

</div>

Logstash does not act as a proxy for queries to Elasticsearch. Why would you want to do this?

---

<div class="post-metadata">

### Author: ![mhsankar](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@mhsankar](https://discuss.elastic.co/u/mhsankar)
#### Post date: [October 31, 2018, 12:48pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/3 "2018-10-31T12:48:03Z")

</div>

i want to handle my queries.  
i want to know what user? from ip? what query? request.  
there is no way to use logstash as pipeline?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 31, 2018, 12:50pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/4 "2018-10-31T12:50:55Z")

</div>

Sounds like you want to set up a proxy in front of Elasticsearch to log this kind of information. This logged data can the be read and processed by Filebeat and/or Logstash. You may also be able to collect this type of information using Packetbeat.

---

<div class="post-metadata">

### Author: ![mhsankar](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@mhsankar](https://discuss.elastic.co/u/mhsankar)
#### Post date: [October 31, 2018, 12:54pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/5 "2018-10-31T12:54:19Z")

</div>

So - you say offer me i use Packetbeat to log my queries?  
and logstash just as a pipeline send data from every one to elastic or elastic data to a specific target?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 31, 2018, 12:56pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/6 "2018-10-31T12:56:19Z")

</div>

That might be an option worth exploring. Packetbeat can write directly to Elasticsearch as well, so whether you need Logstash or not depends on what you want to do with the data.

---

<div class="post-metadata">

### Author: ![mhsankar](https://avatars.discourse-cdn.com/v4/letter/m/bbe5ce/32.png) [@mhsankar](https://discuss.elastic.co/u/mhsankar)
#### Post date: [October 31, 2018, 12:59pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/7 "2018-10-31T12:59:39Z")

</div>

Sorry im confusing.  
Packetbeat log data and write in elasticsearch?  
what is Packetbeat exactly doing?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [October 31, 2018, 1:02pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/8 "2018-10-31T13:02:28Z")

</div>

[Packetbeat](https://www.elastic.co/products/beats/packetbeat) can listen to and record HTTP traffic. It may be able to do what you are looking for. If it is not, I suspect some kind of custom proxy that records the information you are looking for is probably the way to go.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 28, 2018, 1:02pm UTC](https://discuss.elastic.co/t/how-to-use-send-query-instead-of-elastic-to-logstash/154842/9 "2018-11-28T13:02:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
