# Logstash does not forward logs

**URL:** https://discuss.elastic.co/t/logstash-does-not-forward-logs/213368
**Category:** Logstash
**Created:** [December 30, 2019, 4:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-forward-logs/213368 "2019-12-30T16:44:22Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![d.shulinin](https://avatars.discourse-cdn.com/v4/letter/d/e9bcb4/32.png) [@d.shulinin](https://discuss.elastic.co/u/d.shulinin)
#### Post date: [December 30, 2019, 4:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-forward-logs/213368/1 "2019-12-30T16:44:22Z")

</div>

Hi all.  
I'm facing a strange issue with logstash 7.2.0.  
I have two winlogbeats with a similar config sending logs to logstash (elk-1). Logstash then sends the logs to elasticsearch node (elk-2).  
I can confirm that logs from both winlogbeat hosts ("wef1" and "wef2") are reaching logstash because I have setup a file output and I do see logs from both hosts in that file. I differentiate events from these two hosts by the field "hostname" which I see in the output file.  
That is I get either events with "hostname":"wef1" and "hostname":"wef2".

Next I have an output config to send the logs from logstash to elasticsearch. However when I perform search across the index in Kibana I see only events from host "wef1".

"elk-1" is the logstash node. "elk-2" is the elasticsearch node. They stand on the same network so there is no firewalling in between.

Here is my logstash config:

```
input {
  beats {
    port => 5045
    id => "winlogbeat-wef"
    tags => ["winlogbeat-wef"]
  }
}

output {
  if "Winlogbeat-Security" in [tags] {
    elasticsearch {
      hosts => ["elk-2:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-security-%{[@metadata][version]}-%{+YYYY.MM.dd}"}
    file {
      path => "/tmp/win_wef.log"
    }
}

```

Here is the beats config on both nodes:

```
winlogbeat.event_logs:
- name: ForwardedSecurityLog
    forwarded: true
    tags: ["Winlogbeat-Security"]
    ignore_older: 24h
output.logstash:
  hosts: ["elk-1:5045"]

```

Please advise how to debug the issue.  
I've turned on debug log in logstash and elasticsearch but have not discovered anything specific.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2020, 4:44pm UTC](https://discuss.elastic.co/t/logstash-does-not-forward-logs/213368/2 "2020-01-27T16:44:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.