# Receive Elasticsearch API connection with Logstash

**URL:** <https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541>\
**Category:** Logstash\
**Created:** [May 26, 2025, 1:08pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541 "2025-05-26T13:08:10Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [May 26, 2025, 1:08pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541/1 "2025-05-26T13:08:10Z")

</div>

Hi,

I have a tool (Icinga 2) that can write data into Elasticsearch. For a special project I need to reroute some of the data to Kafka.

Can I use Logstash to receive and reroute the data? I mean is there an input that can mimic Elasticsearch or would a simple `http` input be sufficient?

Thanks,  
Thomas

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 26, 2025, 1:18pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541/2 "2025-05-26T13:18:41Z")

</div>

> [@widhalmt](#):
>
> Can I use Logstash to receive and reroute the data? I mean is there an input that can mimic Elasticsearch or would a simple `http` input be sufficient?

There is no such input, you would need to test if the `http` input works or not, this is not something that is commonly done.

The `http` input may work, but one of the issues that you may have is related to authentcation.

This tool does not have other ways to output its data?

---

<div class="post-metadata">

**Author:** ![widhalmt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/widhalmt/32/8237_2.png) [@widhalmt](https://discuss.elastic.co/u/widhalmt)\
**Post date:** [May 26, 2025, 1:23pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541/3 "2025-05-26T13:23:42Z")

</div>

Thanks for your extremely fast reply.

Yes, Icinga 2 has lots of different outputs. The problem is that most of them have a similar problem. Like an Influx Output, Graphite Output etc.

But just as I checked back to give you a reply with what Icinga can and can not do I found that it also has a `GELF` output and that's something Logstash can receive. So that should work!

Sorry for missing the GELF feature, otherwise I wouldn't have bothered you. I'll give it a try and let you know if it works.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [May 26, 2025, 1:35pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541/4 "2025-05-26T13:35:33Z")

</div>

Yeah, using GELF would be better I think, it would be more flexible than trying to do Logstash answer the requests as it were Elasticsearch.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 26, 2025, 2:04pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541/5 "2025-05-26T14:04:07Z")

</div>

If the tool expects per-document response codes in the response to a \_bulk request then no, logstash cannot do that. If you just wanted to consume a \_bulk request using logstash then [this](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567) thread (and threads it spawned) may help convince you not to do that 😃 .