# Logstash and Tenable LCE

**URL:** <https://discuss.elastic.co/t/logstash-and-tenable-lce/33925>\
**Category:** Logstash\
**Created:** [November 5, 2015, 8:34pm UTC](https://discuss.elastic.co/t/logstash-and-tenable-lce/33925 "2015-11-05T20:34:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jackal9301](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jackal9301/32/5748_2.png) [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\
**Post date:** [November 5, 2015, 8:34pm UTC](https://discuss.elastic.co/t/logstash-and-tenable-lce/33925/1 "2015-11-05T20:34:58Z")

</div>

My company has recently switched our logging solution. We used to have multiple inputs from different servers, however now we are getting all logs from a single device. So I have a few questions;

1. Has anyone used Tenable LCE boxes as an input?
2. Has anyone dealt with the LCE header?
3. I'm considering making an input plugin but I'm not a programmer. Anything specific I should know?

My current configuration is taking a udp stream input then filtering everything with grok and adding a sort field which I then run conditional statements on breaking down each type of log a different way. My output will be Elasticsearch however I am currently just dumping files in and out of Logstash creating individual GROK patterns for each separate log type. I am using Logstash 2.0 and accumulating about 1MB of logs per second. I am trying to find the most efficient way to run all of this data through. Any thought, input, or idea will help alot.

Thanks,  
Jackal

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:23am UTC](https://discuss.elastic.co/t/logstash-and-tenable-lce/33925/2 "2017-07-06T05:23:44Z")

</div>

Closed on July 6, 2017, 5:23am UTC