# Ship filtered logs to logstash server from remote server

**URL:** <https://discuss.elastic.co/t/ship-filtered-logs-to-logstash-server-from-remote-server/20614>\
**Category:** Elasticsearch\
**Created:** [November 6, 2014, 6:46pm UTC](https://discuss.elastic.co/t/ship-filtered-logs-to-logstash-server-from-remote-server/20614 "2014-11-06T18:46:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![vilas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vilas/32/613_2.png) [@vilas](https://discuss.elastic.co/u/vilas)\
**Post date:** [November 6, 2014, 6:46pm UTC](https://discuss.elastic.co/t/ship-filtered-logs-to-logstash-server-from-remote-server/20614/1 "2014-11-06T18:46:55Z")

</div>

Hi all,

I have ELK framework setup on my system.  
I am interested collecting logs from remote server and forward them to ELK  
server.  
I see there are logstash shipper and logstash forwarder approaches to do  
that.  
My remote servers have huge logs which I can't just forward without  
filtering as it choke the network.  
So,

1. can I do filtering on remote servers, and then forward only the  
filtered logs to ELK server for indexing?
2. What could be the performance impact to have logstash filtering on  
each remote servers?
3. What architecture is suggested for scenarios with large logs on  
remote servers?

Your help would be appreciated.

Thanks,  
Vilas

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/b57dbe64-dc46-4f80-9443-9dd73aadc19c%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/b57dbe64-dc46-4f80-9443-9dd73aadc19c%40googlegroups.com).  
For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 12:51am UTC](https://discuss.elastic.co/t/ship-filtered-logs-to-logstash-server-from-remote-server/20614/2 "2017-07-06T00:51:41Z")

</div>

Closed on July 6, 2017, 12:51am UTC