# Pulling logs from remote machine

**URL:** <https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309>\
**Category:** Logstash\
**Created:** [March 2, 2016, 9:25pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309 "2016-03-02T21:25:54Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [March 2, 2016, 9:25pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/1 "2016-03-02T21:25:54Z")

</div>

How can I configure logstash to read from a particular log file on a remote location of a server?

In other words, how can I pull logs from remote machines?

Please provide me with couple of options..

---

<div class="post-metadata">

**Author:** ![arizonawayfarer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arizonawayfarer/32/44846_2.png) [@arizonawayfarer](https://discuss.elastic.co/u/arizonawayfarer)\
**Post date:** [March 2, 2016, 9:41pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/2 "2016-03-02T21:41:09Z")

</div>

You can use logstash or filebeat to read log files off of servers and send them to elastic.

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [March 2, 2016, 9:45pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/3 "2016-03-02T21:45:14Z")

</div>

Thanks!

To be more specific, I have a hadoop HDFS system that is summarizing the logs...so i have to get those logs onto elastic search and display it on the kibana dashboard

What is the best approach to that?

---

<div class="post-metadata">

**Author:** ![arizonawayfarer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/arizonawayfarer/32/44846_2.png) [@arizonawayfarer](https://discuss.elastic.co/u/arizonawayfarer)\
**Post date:** [March 2, 2016, 9:49pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/4 "2016-03-02T21:49:56Z")

</div>

How are the logs landing on HDFS? Could you run filebeat or logstash on the log source? Other than that, you would probably need to mount your filesystem using something like FUSE and read them off that way. I have no idea if that would actually work, though. I feel like putting things into HDFS and then pulling them out would be bad.  
[https://wiki.apache.org/hadoop/MountableHDFS](https://wiki.apache.org/hadoop/MountableHDFS)

Logstash contains a hadoop output plugin, but I'm not aware of any hadoop input plugin.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 2, 2016, 9:58pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/5 "2016-03-02T21:58:41Z")

</div>

We have a hadoop connector/client you could use to import them into ES as well, but you'd probably skip going through LS if that were the case.

---

<div class="post-metadata">

**Author:** ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)\
**Post date:** [March 2, 2016, 10:30pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/6 "2016-03-02T22:30:25Z")

</div>

Is the Hadoop client/connector capable of reading/pulling logs from HDFS?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 2, 2016, 11:06pm UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/7 "2016-03-02T23:06:57Z")

</div>

Yep - [https://www.elastic.co/guide/en/elasticsearch/hadoop/current/index.html](https://www.elastic.co/guide/en/elasticsearch/hadoop/current/index.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:08am UTC](https://discuss.elastic.co/t/pulling-logs-from-remote-machine/43309/8 "2017-07-06T05:08:43Z")

</div>


