# Use filebeat as a relay?

**URL:** https://discuss.elastic.co/t/use-filebeat-as-a-relay/245055
**Category:** Beats
**Tags:** filebeat
**Created:** [August 14, 2020, 6:44pm UTC](https://discuss.elastic.co/t/use-filebeat-as-a-relay/245055 "2020-08-14T18:44:23Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![astateofmind](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/astateofmind/32/73905_2.png) [@astateofmind](https://discuss.elastic.co/u/astateofmind)
#### Post date: [August 14, 2020, 6:44pm UTC](https://discuss.elastic.co/t/use-filebeat-as-a-relay/245055/1 "2020-08-14T18:44:24Z")

</div>

I have a bit more complicated setup.

But what I want is something similar to what's below:

Host1 -\> Host2 -\> Logstash -\> ES.

And i want to ship the metrics and logs from Host1 to ES.

Metrics and logs from Host2 are ingested correctly in logstash, ES.

I see that filebeat has a TCP input and was hoping that would allow me to relay the messages from a different filebeat service but it doesn't work. I can set filebeat on Host2 to use input: tcp but there is no related output configuration for Host1 (i tried logstash output and obviously seems to not be working)

So my question: what would be the easiest way to ship my logs from Host1 to Logstash using Host2 as a relay?

Preferable without installing too many components.

It would be great if i could use Host2 filebeat service to do that, if possible. And without overriding the message fields.  
Or a reverse minimal proxy server (i don't want to allow Host1 access to whole Logstash network - it does work with a minimal socks prosy but that allows access to all the network).

Any ideas?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 11, 2020, 6:44pm UTC](https://discuss.elastic.co/t/use-filebeat-as-a-relay/245055/2 "2020-09-11T18:44:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
