# Transfering logs by Logstash to Logstash - help needed **URL:** \ **Category:** Logstash\ **Created:** [December 15, 2015, 9:14am UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218 "2015-12-15T09:14:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@daniel2](https://discuss.elastic.co/u/daniel2)\ **Post date:** [December 15, 2015, 9:14am UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218/1 "2015-12-15T09:14:26Z")
Hey guys! I have a problem with configuring Logstash to send logs to Logstash on a different server. I was able to send logs from Agent1 server by Filebeat to Logstash on Agent2 server, but i don't know how to send logs by Logstash on Agent2 to Logstash on Agent3 server... Just nothing happends then, and I don't know what is missing in configuration files. Below is configuration of Logstash on Agent2: input { stdin { } beats { port =\> 5044 } } filter { grok { match =\> { "message" =\> "^?(?._) - ?(?\{._)" } } json { source =\> "logged\_json" remove\_field =\> ["logged\_json"] remove\_field =\> ["message"] remove\_field =\> ["@timestamp"] #add\_field =\> { "moment" =\> "%{moment}" } } } output { tcp { host =\> "10.xxx.xxx.xx" port =\> 5044 } } And here below is configuration of logstash on Agent3 server: input { stdin { } tcp { port =\> 5044 } } output { stdout { codec =\> "json" } file { path =\> "C:\Logins\ELK\logstash-2.1.0\test.txt" } } Can Someone please help me find what is missing? Why Logstash don't send logs to Logstash on Agent3? ---
**Author:** ![rclarke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rclarke/32/68604_2.png) [@rclarke](https://discuss.elastic.co/u/rclarke)\ **Post date:** [December 15, 2015, 11:16am UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218/2 "2015-12-15T11:16:56Z")
Hello Daniel, You probably want to use the [lumberjack output](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-lumberjack.html) for the agent sending the logs, and the [lumberjack input](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-lumberjack.html) for receiving these. Lumberjack is much more robust and secure compared to tcp. 🙂 Cheers, -Robin- ---
**Author:** ![daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@daniel2](https://discuss.elastic.co/u/daniel2)\ **Post date:** [December 15, 2015, 1:29pm UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218/3 "2015-12-15T13:29:27Z")
Hi Robin, I wanted a tcp, i work in a Bank on closed enviroments INT,UAT,QUA, so there is no need for extra security, but I'm really grateful for your suggestion, I will keep that in mind. I wasn't sure did I configure Logstash properly, but it seems ok... It appears that there are just some delays with transfer, 7 min top... and that I have issues with patience lol 😛 ---
**Author:** ![rclarke](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rclarke/32/68604_2.png) [@rclarke](https://discuss.elastic.co/u/rclarke)\ **Post date:** [December 15, 2015, 1:43pm UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218/4 "2015-12-15T13:43:07Z")
Hi Daniel, When I said security I was not only talking about the security of the data connection, but also the security of the data packets - i.e. a less lossy connection than TCP can be. 7 minutes seems like a high latency... how are you measuring it, and where are you seeing the latency (between logstash-\>logstash, or logstash-\>elasticsearch). Cheers, -Robin- ---
**Author:** ![daniel2](https://avatars.discourse-cdn.com/v4/letter/d/b2d939/32.png) [@daniel2](https://discuss.elastic.co/u/daniel2)\ **Post date:** [December 15, 2015, 2:50pm UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218/5 "2015-12-15T14:50:35Z")
Hi Robin, This 7 min its fine, logs will be checked on the end of each day so at this moment its really not a problem. When windows update file with logs on Agent3 i see this time difference between Agent1 and Agent3. Maybe problem lays a little bit in our Bank Network, because it's a quite messy subject, there is a lot security bariers even in closed enviroments, or with the local firewalls, it's hard to say I need to check everything in our infrastructure first, to be sure, I just started with Logstash, so there is a lot of things for me to get known with. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:18am UTC](https://discuss.elastic.co/t/transfering-logs-by-logstash-to-logstash-help-needed/37218/6 "2017-07-06T05:18:21Z")