# Journalbeat in Elastic SIEM **URL:** \ **Category:** SIEM\ **Created:** [September 3, 2020, 12:25am UTC](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305 "2020-09-03T00:25:27Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Alfredo1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alfredo1/32/75003_2.png) [@Alfredo1](https://discuss.elastic.co/u/Alfredo1)\ **Post date:** [September 3, 2020, 12:25am UTC](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305/1 "2020-09-03T00:25:27Z")
I recently started consuming HashiCorp Vault (secrets manager) audit logs into my cluster via Journalbeat, and while it's great to view the logs in Discover, it would be useful to surface those logs and associated metrics in the SIEM app. Any thoughts on this? ---
**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\ **Post date:** [September 3, 2020, 12:17pm UTC](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305/2 "2020-09-03T12:17:02Z")
Hi @Alfredo1, Unfortunately, it is not currently possible to transmit journald events to the SIEM app via Journalbeat. However, the [HashiCorp docs](https://www.hashicorp.com/resources/adopting-hashicorp-vault/), mention their audit logs are generally sent as syslog or JSON to a SIEM. Could you generate some sample events and provide us with the output (sanitised events are fine). Filebeat may be able to ship these events to the SIEM app, depending on the format. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 1, 2020, 12:17pm UTC](https://discuss.elastic.co/t/journalbeat-in-elastic-siem/247305/3 "2020-10-01T12:17:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.