# Shipping access logs logstash to logstash using http plugins

**URL:** <https://discuss.elastic.co/t/shipping-access-logs-logstash-to-logstash-using-http-plugins/343980>\
**Category:** Logstash\
**Created:** [September 27, 2023, 12:31pm UTC](https://discuss.elastic.co/t/shipping-access-logs-logstash-to-logstash-using-http-plugins/343980 "2023-09-27T12:31:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Casper\_Thrane](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/casper_thrane/32/49777_2.png) [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\
**Post date:** [September 27, 2023, 12:31pm UTC](https://discuss.elastic.co/t/shipping-access-logs-logstash-to-logstash-using-http-plugins/343980/1 "2023-09-27T12:31:03Z")

</div>

Hi

We have a setup where we ship logs between systems via logstash to logstash using http plugins. The access logs are in ecs format. The problem is, logstash overwrites http, url and others fields, with it's own transport information. Can this be solved without renaming original fields before sending, and then again after receiving?

Br  
Casper

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 27, 2023, 12:42pm UTC](https://discuss.elastic.co/t/shipping-access-logs-logstash-to-logstash-using-http-plugins/343980/2 "2023-09-27T12:42:38Z")

</div>

> [@Casper\_Thrane](#):
>
> Can this be solved without renaming original fields before sending, and then again after receiving?

You may disable the `ecs_compatibility` in the receiving logstash, but other fields, like `host` and `headers` will be overwritten as explained in the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-http.html#plugins-inputs-http-ecs_metadata).

I don't think this can be disabled, at least there is nothing in the documentation about it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2023, 12:43pm UTC](https://discuss.elastic.co/t/shipping-access-logs-logstash-to-logstash-using-http-plugins/343980/3 "2023-10-25T12:43:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.