# Logs Pulling Architecture

**URL:** <https://discuss.elastic.co/t/logs-pulling-architecture/341438>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-monitoring, elastic-stack-security\
**Created:** [August 23, 2023, 7:50am UTC](https://discuss.elastic.co/t/logs-pulling-architecture/341438 "2023-08-23T07:50:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Raz\_Maabari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/raz_maabari/32/100374_2.png) [@Raz\_Maabari](https://discuss.elastic.co/u/Raz_Maabari)\
**Post date:** [August 23, 2023, 7:50am UTC](https://discuss.elastic.co/t/logs-pulling-architecture/341438/1 "2023-08-23T07:50:18Z")

</div>

Filebeat uses a "push" architecture, sending logs to logstash or elastic. Is there a feature or product that would enable elastic to receive hosts' logs using a "pull" architecture?

In my setup, I have network connectivity only from my elasticsearch cluster to the hosts I would like to collect the logs from, so I can't use the default log shipping architecture of filebeat or fluentbit.

Thanks!

---

<div class="post-metadata">

**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\
**Post date:** [August 23, 2023, 1:10pm UTC](https://discuss.elastic.co/t/logs-pulling-architecture/341438/2 "2023-08-23T13:10:00Z")

</div>

Hi,

Elastic has some options for pulling logs:  
We use the logstash `jdbc` input to pull logs from our databases.  
We use the logstash `http_poller` input to get the current state of some machines.

For logs, your best way - although not strictly a pull architecture - might be to use a message bus:  
You decouple the production from the logging system as both systems only talk to the messagebus server (e.g. Kafka). Filebeat already supports Kafka for both input and output, so you could run a FileBeat on the production system sending the logs and a FileBeat instance on the elasticsearch cluster consuming them.

Best regards  
Wolfram

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2023, 1:10pm UTC](https://discuss.elastic.co/t/logs-pulling-architecture/341438/3 "2023-09-20T13:10:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.