# Implementation question: Central syslog server vs filebeat on each machine

**URL:** <https://discuss.elastic.co/t/implementation-question-central-syslog-server-vs-filebeat-on-each-machine/227517>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 10, 2020, 2:19pm UTC](https://discuss.elastic.co/t/implementation-question-central-syslog-server-vs-filebeat-on-each-machine/227517 "2020-04-10T14:19:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![andywt123](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andywt123/32/65160_2.png) [@andywt123](https://discuss.elastic.co/u/andywt123)\
**Post date:** [April 10, 2020, 2:19pm UTC](https://discuss.elastic.co/t/implementation-question-central-syslog-server-vs-filebeat-on-each-machine/227517/1 "2020-04-10T14:19:21Z")

</div>

I am new to elasticsearch. We are currently migrating from Splunk to Elastic. When we setup splunk the best practice was to use a central syslog server and ingest all the different servers logs from one point. Does Elastic have a best practice concerning this? Does it make more sense to install Filebeat on every server and manage them individually or use rsyslog to forward them to one location and then ingest them?

Thanks

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [April 10, 2020, 5:32pm UTC](https://discuss.elastic.co/t/implementation-question-central-syslog-server-vs-filebeat-on-each-machine/227517/2 "2020-04-10T17:32:12Z")

</div>

Hey @andywt123, welcome to discuss 🙂

Good to see that you are giving a try to Filebeat 🙂

To make the most of Filebeat it is recommended to install it on every server, this way all the data collected can be better enriched with metadata only available locally on each server, and you can use different modules depending on the software installed on each one of the servers.

Although not recommended, if in your case it is not possible to install Filebeat in all your servers for any reason, you can still forward the logs to a machine and install Filebeat there for ingestion. Filebeat can also act as syslog server using the syslog input.

You can read more about enriching events with metadata here: [https://www.elastic.co/guide/en/beats/filebeat/7.6/filtering-and-enhancing-data.html](https://www.elastic.co/guide/en/beats/filebeat/7.6/filtering-and-enhancing-data.html)  
For the available modules, take a look here: [https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-modules.html](https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-modules.html)  
For the available inputs, here: [https://www.elastic.co/guide/en/beats/filebeat/7.6/configuration-filebeat-options.html](https://www.elastic.co/guide/en/beats/filebeat/7.6/configuration-filebeat-options.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2020, 5:32pm UTC](https://discuss.elastic.co/t/implementation-question-central-syslog-server-vs-filebeat-on-each-machine/227517/3 "2020-05-08T17:32:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.