# Logs monitoring through Filebeat

**URL:** <https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753>\
**Category:** Beats\
**Tags:** elastic-stack-monitoring, filebeat\
**Created:** [May 18, 2023, 9:25am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753 "2023-05-18T09:25:21Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kumar\_Arsh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumar_arsh/32/121168_2.png) [@Kumar\_Arsh](https://discuss.elastic.co/u/Kumar_Arsh)\
**Post date:** [May 18, 2023, 9:25am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/1 "2023-05-18T09:25:21Z")

</div>

How can I use filebeat to read logs from another server? What will be the configuration that will be required?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 18, 2023, 10:32am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/2 "2023-05-18T10:32:45Z")

</div>

It's not impossible, but not recommend. Check [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-network-volumes.html).

Another option is to make a tail replication.

---

<div class="post-metadata">

**Author:** ![Kumar\_Arsh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumar_arsh/32/121168_2.png) [@Kumar\_Arsh](https://discuss.elastic.co/u/Kumar_Arsh)\
**Post date:** [May 18, 2023, 11:08am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/3 "2023-05-18T11:08:18Z")

</div>

What's tail replication?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 18, 2023, 12:07pm UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/4 "2023-05-18T12:07:22Z")

</div>

When you copy only last line(s) content (tail) to another location. In your case, it will copy lines from the network to local FB server, which will read then by FB.  
There is an excellent tool Robocopy on Windows platform.

---

<div class="post-metadata">

**Author:** ![Kumar\_Arsh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumar_arsh/32/121168_2.png) [@Kumar\_Arsh](https://discuss.elastic.co/u/Kumar_Arsh)\
**Post date:** [May 19, 2023, 6:43am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/5 "2023-05-19T06:43:22Z")

</div>

Any suggestions for Linux?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 19, 2023, 7:39am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/6 "2023-05-19T07:39:19Z")

</div>

Not sure will achieve your needs, check rsync or lsync.

---

<div class="post-metadata">

**Author:** ![Kumar\_Arsh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kumar_arsh/32/121168_2.png) [@Kumar\_Arsh](https://discuss.elastic.co/u/Kumar_Arsh)\
**Post date:** [May 23, 2023, 9:38am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/7 "2023-05-23T09:38:31Z")

</div>

Can I use filebeat to send logs to another server (where elasticsearch is installed)?

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 23, 2023, 10:04am UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/8 "2023-05-23T10:04:04Z")

</div>

If you mean copy logs from server A to B like mirror, not sure, will add additional metadata,  
If you mean can you use FB to send logs directly to ES, yes you can by [an ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)

I don't know what is you a log source, is it a specific device or just an application, there is also option to send via TCP. If is the application, just set FB and send to ES. You will need to configure FB and the ingest pipeline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 20, 2023, 12:04pm UTC](https://discuss.elastic.co/t/logs-monitoring-through-filebeat/333753/9 "2023-06-20T12:04:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
