# Logstash forwarder question

**URL:** <https://discuss.elastic.co/t/logstash-forwarder-question/34955>\
**Category:** Logstash\
**Created:** [November 18, 2015, 3:05pm UTC](https://discuss.elastic.co/t/logstash-forwarder-question/34955 "2015-11-18T15:05:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ariel\_Assaraf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ariel_assaraf/32/22545_2.png) [@Ariel\_Assaraf](https://discuss.elastic.co/u/Ariel_Assaraf)\
**Post date:** [November 18, 2015, 3:05pm UTC](https://discuss.elastic.co/t/logstash-forwarder-question/34955/1 "2015-11-18T15:05:39Z")

</div>

Hi all, we at Coralogix are working on a logstash forwarder to our Log Analytics application.  
Since we need the log data structured we need the user to do some pre-definitions.

**The question is:** will you as Logstash users be OK with an integration that requires you to do the following?

I would love to get your opinion since the ease of integration is very important to us, thanks!

1. create "application" and "subsystem" fields in each logstash forwarder configuration file:  
"files": [  
{  
"paths": [  
...  
],  
"fields": { "type": "applicationlog",  
"application\_name": "Middleware",  
"subsystem\_name": "requests" }  
}

2. create grok filter and regexs to parse each log message for the following: timestamp, severity, category, class, method

3. add coralogix output plugin, with the private key as parameter, no other config needed here.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [November 24, 2015, 7:16am UTC](https://discuss.elastic.co/t/logstash-forwarder-question/34955/2 "2015-11-24T07:16:09Z")

</div>

Since logstash-forwarder is deprecated is favor of Filebeat I wouldn't be too happy about a software vendor requiring me to use LSF but apart from that what you say makes sense on a high level.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:21am UTC](https://discuss.elastic.co/t/logstash-forwarder-question/34955/3 "2017-07-06T05:21:36Z")

</div>