# Input elasticsearch log files into ELK

**URL:** <https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362>\
**Category:** Elasticsearch\
**Created:** [November 5, 2018, 8:43am UTC](https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362 "2018-11-05T08:43:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![cowensel](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cowensel](https://discuss.elastic.co/u/cowensel)\
**Post date:** [November 5, 2018, 8:43am UTC](https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362/1 "2018-11-05T08:43:17Z")

</div>

Is there a way to either pass the elasticsearch logs into the Elk Stack or output it into a readable format.

I have neglected the elasticsearch log files and would like them to be put out in a readable format for users to understand.

If anyone can assist it would be great.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 5, 2018, 9:53am UTC](https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362/2 "2018-11-05T09:53:07Z")

</div>

[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html), but just be aware of the opening note.

---

<div class="post-metadata">

**Author:** ![cowensel](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cowensel](https://discuss.elastic.co/u/cowensel)\
**Post date:** [November 5, 2018, 12:11pm UTC](https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362/3 "2018-11-05T12:11:37Z")

</div>

We are running 6.0.0 of elasticsearch which isn't supported with the filebeat module. Could we use filebeat and let it read from the log file itself or will it not format correctly?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [November 5, 2018, 8:24pm UTC](https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362/4 "2018-11-05T20:24:43Z")

</div>

The beat should still be able to talk to Elasticsearch, so I don't think it will be a problem.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 3, 2018, 8:24pm UTC](https://discuss.elastic.co/t/input-elasticsearch-log-files-into-elk/155362/5 "2018-12-03T20:24:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.