# Trying to forward multiple filebeats via a filebeat relay

**URL:** https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886
**Category:** Beats
**Tags:** filebeat
**Created:** [December 7, 2020, 6:17pm UTC](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886 "2020-12-07T18:17:10Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![dorj1234](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dorj1234/32/21339_2.png) [@dorj1234](https://discuss.elastic.co/u/dorj1234)
#### Post date: [December 7, 2020, 6:17pm UTC](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886/1 "2020-12-07T18:17:11Z")

</div>

Hello,  
I have multiple machines running filebeat and a logstash host in my cloud environment.  
To minimize firewall impact, I created a single VM to be a relay, and forward everything from the other filebeats to the outside world.

For some reason this doesn't work.  
Has anyone tried this before?

Here is an example yml setup:  
filebeat.inputs:  
- type: tcp  
host: "localhost:{{inbound-port}}"  
output.logstash:  
enabled: true  
hosts: ["my\_logstash\_host:9999"]  
ssl:  
verification\_mode: "none"

Similar past post (locked):

> [@Filebeat relay](https://discuss.elastic.co/t/filebeat-relay/245504):
>
> So, i'm trying to do something ... weird. Filebeat01 - \> filebeat02-\> logstash. On filebeat01 i enabled logstash output with filbeat02 as target and on filebeat02 tcp input. The json from the first filebat is encapultated in the "message" field of the filebeat02 and it will enter logstash with the metadata and all fields of filbeat02 and in filebeat02's message the full json of filebeat01. Would it be possible to overwrite the metadata and all fields from the "outer" json with the fields from…

Thanks in advance!  
JD

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2021, 8:17pm UTC](https://discuss.elastic.co/t/trying-to-forward-multiple-filebeats-via-a-filebeat-relay/257886/2 "2021-01-04T20:17:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.