Trying to forward multiple filebeats via a filebeat relay

[dorj1234 (Dor Juravski)]

Hello,
I have multiple machines running filebeat and a logstash host in my cloud environment.
To minimize firewall impact, I created a single VM to be a relay, and forward everything from the other filebeats to the outside world.

For some reason this doesn't work.
Has anyone tried this before?

Here is an example yml setup:
filebeat.inputs:
- type: tcp
host: "localhost:{{inbound-port}}"
output.logstash:
enabled: true
hosts: ["my_logstash_host:9999"]
ssl:
verification_mode: "none"

Similar past post (locked):

Filebeat relay

So, i'm trying to do something ... weird. Filebeat01 - > filebeat02-> logstash. On filebeat01 i enabled logstash output with filbeat02 as target and on filebeat02 tcp input. The json from the first filebat is encapultated in the "message" field of the filebeat02 and it will enter logstash with the metadata and all fields of filbeat02 and in filebeat02's message the full json of filebeat01. Would it be possible to overwrite the metadata and all fields from the "outer" json with the fields from…

Thanks in advance!
JD