# Log Forwarding Capabilities

**URL:** https://discuss.elastic.co/t/log-forwarding-capabilities/334627
**Category:** Logstash
**Created:** [May 30, 2023, 1:11am UTC](https://discuss.elastic.co/t/log-forwarding-capabilities/334627 "2023-05-30T01:11:44Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [June 1, 2023, 2:20am UTC](https://discuss.elastic.co/t/log-forwarding-capabilities/334627/5 "2023-06-01T02:20:32Z")

</div>

You would use pipeline-to-pipeline with a [forked-path pattern](https://www.elastic.co/guide/en/logstash/current/pipeline-to-pipeline.html#forked-path-pattern).

The input would send events to two pipelines, one would just send those events to a syslog output, the other would parse them and route them to elasticsearch.

To parse CEF you can use the [codec](https://www.elastic.co/guide/en/logstash/current/plugins-codecs-cef.html). You cannot use a codec on a pipeline-to-pipeline connection, but there is an example of how to do it using a TCP output/input pair [here](https://discuss.elastic.co/t/filter-cef/181215/5). Do not try to do it like [this](https://discuss.elastic.co/t/logstash-configuration-input-error-with-if-statement/246019/10).

If you have problems with parsing the syslog timestamp then [this](https://discuss.elastic.co/t/logstash-cef-codec-and-ecs-cannot-parse-rt-field-throws-an-error/310705/2) might help.

---

_[View the full topic](https://discuss.elastic.co/t/log-forwarding-capabilities/334627)._