# Pull instead of push

**URL:** <https://discuss.elastic.co/t/pull-instead-of-push/56033>\
**Category:** Beats\
**Created:** [July 20, 2016, 10:18pm UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033 "2016-07-20T22:18:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\
**Post date:** [July 20, 2016, 10:18pm UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033/1 "2016-07-20T22:18:17Z")

</div>

Is there a specific beat or a way anyone knows where i can have my ELK server pull data from a syslog server? Instead of having to install a beat on my syslog server and pushing the data to my ELK server. I do not know if this is even possible but if any one knows of a way I would really appreciate it.

---

<div class="post-metadata">

**Author:** ![medcl.net](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/medcl.net/32/4414_2.png) [@medcl.net](https://discuss.elastic.co/u/medcl.net)\
**Post date:** [July 21, 2016, 2:14am UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033/2 "2016-07-21T02:14:41Z")

</div>

Hi, @Dalton_Culp  
I don't think it is a good idea to pull data from Syslog server, and AFAIK the Syslog server doesn't provide such feature.

Instead of pulling by using beats, you may still use use syslog and with Omelasticsearch output([http://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html](http://www.rsyslog.com/doc/v8-stable/configuration/modules/omelasticsearch.html)) to send data from ES, or with OmKafka output ([http://www.rsyslog.com/doc/master/configuration/modules/omkafka.html](http://www.rsyslog.com/doc/master/configuration/modules/omkafka.html)) for data safety.

Another option is to use Logstash with syslog input, here is a good article you may look: [https://www.elastic.co/blog/how-to-centralize-logs-with-rsyslog-logstash-and-elasticsearch-on-ubuntu-14-04](https://www.elastic.co/blog/how-to-centralize-logs-with-rsyslog-logstash-and-elasticsearch-on-ubuntu-14-04)

---

<div class="post-metadata">

**Author:** ![Dalton\_Culp](https://avatars.discourse-cdn.com/v4/letter/d/e47c2d/32.png) [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\
**Post date:** [July 21, 2016, 4:35pm UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033/3 "2016-07-21T16:35:37Z")

</div>

What if i map to that drive? @medcl1

---

<div class="post-metadata">

**Author:** ![medcl.net](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/medcl.net/32/4414_2.png) [@medcl.net](https://discuss.elastic.co/u/medcl.net)\
**Post date:** [July 25, 2016, 12:17pm UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033/4 "2016-07-25T12:17:23Z")

</div>

@Dalton_Culp did you mean map that disk like NFS way, and read logs locally?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2016, 10:18pm UTC](https://discuss.elastic.co/t/pull-instead-of-push/56033/5 "2016-08-10T22:18:18Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.