# Use logstash as proxy for elasticsearch

**URL:** <https://discuss.elastic.co/t/use-logstash-as-proxy-for-elasticsearch/125980>\
**Category:** Logstash\
**Created:** [March 28, 2018, 6:02pm UTC](https://discuss.elastic.co/t/use-logstash-as-proxy-for-elasticsearch/125980 "2018-03-28T18:02:46Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tarp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarp/32/51884_2.png) [@tarp](https://discuss.elastic.co/u/tarp)\
**Post date:** [March 28, 2018, 6:02pm UTC](https://discuss.elastic.co/t/use-logstash-as-proxy-for-elasticsearch/125980/1 "2018-03-28T18:02:46Z")

</div>

Hi,

I deployed some proxy servers that run logstash and nginx. I do not want developers or users hitting the elasticsearch cluster directly. Logstash provides an input to handle JSON text that logstash turns around and sends to elasticsearch. I have nginx proxying requests to the backend elasticsearch cluster. For data ingestion, it is sometimes nice to be able to manipulate messages as the come through or do other logstash filters on them. Is there a way to configure Logstash to accept traffic like it was elasticsearch api calls and send them on, instead of doing this with nginx? The elasticearch input plugin, is just about querying other clusters, not quite what I'm looking for.

Thanks,  
Tim

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [April 2, 2018, 9:53am UTC](https://discuss.elastic.co/t/use-logstash-as-proxy-for-elasticsearch/125980/2 "2018-04-02T09:53:24Z")

</div>

> Is there a way to configure Logstash to accept traffic like it was elasticsearch api calls and send them on, instead of doing this with nginx?

There's the http input but it won't behave exactly like Elasticsearch. It depends on what exact requirements you have. If you really want a proxy the Nginx would be much more suitable.

---

<div class="post-metadata">

**Author:** ![tarp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tarp/32/51884_2.png) [@tarp](https://discuss.elastic.co/u/tarp)\
**Post date:** [April 5, 2018, 2:05pm UTC](https://discuss.elastic.co/t/use-logstash-as-proxy-for-elasticsearch/125980/3 "2018-04-05T14:05:39Z")

</div>

Thanks for the reply, I thought that was the case I just wanted to see if anyone else had an idea for this.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2018, 2:05pm UTC](https://discuss.elastic.co/t/use-logstash-as-proxy-for-elasticsearch/125980/4 "2018-05-03T14:05:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.