# Logging directly to elasticsearch

**URL:** <https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702>\
**Category:** Elasticsearch\
**Created:** [January 10, 2019, 10:16am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702 "2019-01-10T10:16:54Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![yash\_sachdeva](https://avatars.discourse-cdn.com/v4/letter/y/bcef8e/32.png) [@yash\_sachdeva](https://discuss.elastic.co/u/yash_sachdeva)\
**Post date:** [January 10, 2019, 10:16am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/1 "2019-01-10T10:16:54Z")

</div>

Hi Team, I would like to send pre-formatted json logs directly to elastic search? I would like to avoid logstash/filebeat as I do not need any further parsing. Also, I see in a previous post you have recommended not to avoid logstash, but I want to try and see how I can do precisely that.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 10, 2019, 10:18am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/2 "2019-01-10T10:18:27Z")

</div>

> [@yash\_sachdeva](#):
>
> I see in a previous post you have recommended not to avoid logstash

Which post is that?

---

<div class="post-metadata">

**Author:** ![yash\_sachdeva](https://avatars.discourse-cdn.com/v4/letter/y/bcef8e/32.png) [@yash\_sachdeva](https://discuss.elastic.co/u/yash_sachdeva)\
**Post date:** [January 10, 2019, 10:19am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/3 "2019-01-10T10:19:42Z")

</div>

> [@Send JSON formatted logs directly to elasticsearch](https://discuss.elastic.co/t/send-json-formatted-logs-directly-to-elasticsearch/77470):
>
> Hi there, I have modules that ships JSON formatted logs to ELK stack. I'd like to omit logstash, because I don't really need to parse them additionally. I use jsonevent-layout for java and logstashFormatter for python sources. I'd like to send those JSONs over TCP or UDP directly to elasticsearch. Is there any existing appender that does it properly? Greetings

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 10, 2019, 10:23am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/4 "2019-01-10T10:23:27Z")

</div>

I don't think it's saying not to use it, just saying why you may want to and the benefits it gives.

So if your client can handle things like bulk, retries, load balancing etc, then you should be ok.

---

<div class="post-metadata">

**Author:** ![yash\_sachdeva](https://avatars.discourse-cdn.com/v4/letter/y/bcef8e/32.png) [@yash\_sachdeva](https://discuss.elastic.co/u/yash_sachdeva)\
**Post date:** [January 10, 2019, 10:25am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/5 "2019-01-10T10:25:55Z")

</div>

that's great, but there really is no information on how to actually do it, I mean to send the formatted log file directly to elasticsearch. Please do let me know how we can achieve this. Assuming that the elasticsearch node is open to accepting incoming files from any source in my network.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 10, 2019, 10:26am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/6 "2019-01-10T10:26:34Z")

</div>

It's an index request like any other, so [https://www.elastic.co/guide/en/elasticsearch/reference/6.5/docs-index\_.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/docs-index_.html)

---

<div class="post-metadata">

**Author:** ![yash\_sachdeva](https://avatars.discourse-cdn.com/v4/letter/y/bcef8e/32.png) [@yash\_sachdeva](https://discuss.elastic.co/u/yash_sachdeva)\
**Post date:** [January 10, 2019, 10:32am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/7 "2019-01-10T10:32:06Z")

</div>

Hi Malcolm, apologies for a third follow up, but say i have a well formatted log file, this log file needs to be continuously written to elasticsearch and further to be viewable in Kibana.  
As per my understanding, the article you mentioned allows me to manually put a file into elasticsearch and it would not be a continous process

---

<div class="post-metadata">

**Author:** ![A\_B](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/a_b/32/17104_2.png) [@A\_B](https://discuss.elastic.co/u/A_B)\
**Post date:** [January 10, 2019, 11:41am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/8 "2019-01-10T11:41:49Z")

</div>

> [@yash\_sachdeva](#):
>
> ...I would like to send...

You can not expect Elasticsearch to know what logs to fetch. For sending, _you_ have to take care of that, which was pointed out already

> So if your client can handle things like bulk, retries, load balancing etc, then you should be ok.

That is really what you would use Logstash for, or Filebeat... Or write your own log shipper...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2019, 11:41am UTC](https://discuss.elastic.co/t/logging-directly-to-elasticsearch/163702/9 "2019-02-07T11:41:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
