# Shipping logs from Elasticsearch nodes to Elasticsearch cluster

**URL:** <https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873>\
**Category:** Elasticsearch\
**Created:** [March 12, 2019, 6:45am UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873 "2019-03-12T06:45:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sterago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sterago/32/37035_2.png) [@sterago](https://discuss.elastic.co/u/sterago)\
**Post date:** [March 12, 2019, 6:45am UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/1 "2019-03-12T06:45:47Z")

</div>

Is there a recommended way to ship the logs produced by Elasticsearch nodes over to the Elasticsearch cluster itself for centralized logging purposes?

Thanks in advance for any input

---

<div class="post-metadata">

**Author:** ![lar](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lar](https://discuss.elastic.co/u/lar)\
**Post date:** [March 12, 2019, 11:18am UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/2 "2019-03-12T11:18:28Z")

</div>

Elasticsearch Nodes = Master + Data + Worker + Coordinating Nodes  
Elasticsearch Cluster = Combination of the above

So, I didn't understand the question.. Could you be more specific ?

---

<div class="post-metadata">

**Author:** ![sterago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sterago/32/37035_2.png) [@sterago](https://discuss.elastic.co/u/sterago)\
**Post date:** [March 12, 2019, 11:43am UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/3 "2019-03-12T11:43:42Z")

</div>

Hi Jack, sure.  
My team has an Elasticsearch Cluster used for centralizing the logs produced by different services and applications we own.  
We would like to include also the logs produced by the different nodes that are part of this same Elasticsearch cluster, more specifically, the Elasticsearch server logs. The main goal is to increase observability and simplify debugging issues that sometimes happen in the cluster.

---

<div class="post-metadata">

**Author:** ![lar](https://avatars.discourse-cdn.com/v4/letter/l/47e85d/32.png) [@lar](https://discuss.elastic.co/u/lar)\
**Post date:** [March 12, 2019, 12:12pm UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/4 "2019-03-12T12:12:27Z")

</div>

Add two(for HA) more Logstash nodes for log collection in the cluster itself. And Two (for HA)Logstash pointing to the elasticsearch. So now you will have 4 logstash (two in one subnet and the other two in a different subnet) nodes pointing to your elasticseach.

---

<div class="post-metadata">

**Author:** ![sterago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sterago/32/37035_2.png) [@sterago](https://discuss.elastic.co/u/sterago)\
**Post date:** [March 12, 2019, 1:34pm UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/5 "2019-03-12T13:34:29Z")

</div>

Thanks for your input Jack. We are currently not using Logstash and our setup relies entirely on Filebeat and ingest nodes with certain pipelines for the most exotic log formats, as most of the logs are in JSON anyway. Is there a way we can ingest Elasticsearch logs without resorting to use Logstash? Perhaps by configuring the Elasticsearch logs to use JSON formatting?

---

<div class="post-metadata">

**Author:** ![Shrikant\_Patil](https://avatars.discourse-cdn.com/v4/letter/s/91b2a8/32.png) [@Shrikant\_Patil](https://discuss.elastic.co/u/Shrikant_Patil)\
**Post date:** [March 12, 2019, 2:33pm UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/6 "2019-03-12T14:33:25Z")

</div>

Hi @sterago,

You can send elasticsearch node logs to elasticsearch cluster using filebeat.

here is the filebeat confihuration for elastic output:

```
#-------------------------- Elasticsearch output ------------------------------

    output.elasticsearch:
      # Array of hosts to connect to.
      hosts: ["localhost:9200"]

      # Optional protocol and basic auth credentials.
      protocol: "https"
      username: "changeme"
      password: "changeme"

      ssl.enabled: true

```

Hope this helps.

Thanks,  
Shrikant

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2019, 2:33pm UTC](https://discuss.elastic.co/t/shipping-logs-from-elasticsearch-nodes-to-elasticsearch-cluster/171873/7 "2019-04-09T14:33:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.