# Qradar Logs to Logstash/Elastic?

**URL:** <https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385>\
**Category:** Logstash\
**Created:** [May 29, 2021, 12:44am UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385 "2021-05-29T00:44:06Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![mohamed\_el\_mannouti](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\
**Post date:** [May 29, 2021, 12:44am UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385/1 "2021-05-29T00:44:06Z")

</div>

**we have a Qradar SIEM which we plan to extend to Elastic for threat hunting(Log Forwarding from Qradar to Elastic)**

Has anyone found any success with it. Any known shortcomings/pitfalls from the setup.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 29, 2021, 1:52pm UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385/2 "2021-05-29T13:52:37Z")

</div>

QRadar can forward logs without any problem, you just need to choose how to forward it.

I do not use QRadar anymore, but I would recommend that you forward already in json to logstash, it will give you less work if need or want to transform your data before sending to elasticsearch.

---

<div class="post-metadata">

**Author:** ![mohamed\_el\_mannouti](https://avatars.discourse-cdn.com/v4/letter/m/c57346/32.png) [@mohamed\_el\_mannouti](https://discuss.elastic.co/u/mohamed_el_mannouti)\
**Post date:** [May 29, 2021, 11:30pm UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385/3 "2021-05-29T23:30:36Z")

</div>

thank you for your comment 😇  
Yes that do i want exactly but i don't know how i can do this.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 30, 2021, 12:58am UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385/4 "2021-05-30T00:58:02Z")

</div>

Welcome to our community! 😃

Please don't add unrelated tags to your topics in future 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2021, 12:58am UTC](https://discuss.elastic.co/t/qradar-logs-to-logstash-elastic/274385/5 "2021-06-27T00:58:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.