# Stream logs to elastic search from Fastly

**URL:** https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217
**Category:** Logs
**Created:** [April 10, 2019, 12:24pm UTC](https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217 "2019-04-10T12:24:15Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![soerenfrisk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/soerenfrisk/32/42585_2.png) [@soerenfrisk](https://discuss.elastic.co/u/soerenfrisk)
#### Post date: [April 10, 2019, 12:24pm UTC](https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217/1 "2019-04-10T12:24:15Z")

</div>

I'm trying to find a way to stream logs from [fastly.com](https://fastly.com) to an elastic cloud service. According to Fastly's [docs](https://docs.fastly.com/guides/streaming-logs/about-fastlys-realtime-log-streaming-features) you are only able to do this through Logstash (which is not included in the cloud service). It seems impractical to have and manage a logstash instance for receiving logs from one source.

Anyone have tried to successfully stream logs from Fastly to Elastic search directly?

It seems the only way to stream logs to elastic is through beats.

---

<div class="post-metadata">

### Author: ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [April 11, 2019, 8:45am UTC](https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217/2 "2019-04-11T08:45:45Z")

</div>

Hi @soerenfrisk,

After looking through the list of supported log services in the docs you linked, two paths might be viable:

1. Use logstash or filebeat to forward the syslog stream to Elasticsearch's HTTP API.
2. Try to (ab)use one of the HTTP-based service integrations to submit JSON docs to an [ingest pipeline](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html) on your Elasticserach cluster. If I were to attempt that, I would start with the sumologic integration, because it looks quite generic and configurable. I would point it at a small HTTP server which I control to inspect the format and derive a pipeline from that.

---

<div class="post-metadata">

### Author: ![soerenfrisk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/soerenfrisk/32/42585_2.png) [@soerenfrisk](https://discuss.elastic.co/u/soerenfrisk)
#### Post date: [April 11, 2019, 10:49am UTC](https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217/3 "2019-04-11T10:49:16Z")

</div>

Hi!

Thanks for helping.

How would i go about forwarding the syslog through filebeat? Is there any docs on this? I've only used filebeat as something installed on a server.

---

<div class="post-metadata">

### Author: ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)
#### Post date: [April 12, 2019, 1:38pm UTC](https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217/4 "2019-04-12T13:38:12Z")

</div>

Like logstash, filebeat would have to be set up on some server. Then it can consume syslog packets via its [syslog input](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-syslog.html).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 10, 2019, 1:38pm UTC](https://discuss.elastic.co/t/stream-logs-to-elastic-search-from-fastly/176217/5 "2019-05-10T13:38:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
