# Using Elasticsearch for NON weblogs

**URL:** https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887
**Category:** Elasticsearch
**Created:** [February 25, 2013, 5:21pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887 "2013-02-25T17:21:05Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Justin\_Franks](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Justin\_Franks](https://discuss.elastic.co/u/Justin_Franks)
#### Post date: [February 25, 2013, 5:21pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887/1 "2013-02-25T17:21:05Z")

</div>

Hi gang,  
I have a buttload of logs across a buttload of servers. I am NOT talking  
web logs. I am talking about misc log files on U/Linux systems. Error logs,  
security logs, access logs, _sometimes_ a web log, and other misc system  
message logs. I want to use Elasticsearch for ALL my logs everywhere.  
I assume this is what ES does and can easily handle it. Question is, how do  
I point my logs from multiple systems to ES? For example, how would I point  
/var/messages on machine A to ES running on machine B?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![jprante](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jprante/32/44941_2.png) [@jprante](https://discuss.elastic.co/u/jprante)
#### Post date: [February 25, 2013, 5:23pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887/2 "2013-02-25T17:23:28Z")

</div>

Did you look at rsyslog elasticsearch backend?

[http://wiki.rsyslog.com/index.php/HOWTO:\_rsyslog\_%2B\_elasticsearch](http://wiki.rsyslog.com/index.php/HOWTO:_rsyslog_%2B_elasticsearch)

Jörg

Am 25.02.13 18:21, schrieb Justin Franks:

> Question is, how do I point my logs from multiple systems to ES? For  
> example, how would I point /var/messages on machine A to ES running on  
> machine B?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![Justin\_Franks](https://avatars.discourse-cdn.com/v4/letter/j/f4b2a3/32.png) [@Justin\_Franks](https://discuss.elastic.co/u/Justin_Franks)
#### Post date: [February 25, 2013, 5:30pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887/3 "2013-02-25T17:30:31Z")

</div>

Hi Jörg Prante,  
No, I have not. I'l look at that.  
Thanks for sharing

On Monday, February 25, 2013 9:21:05 AM UTC-8, Justin Franks wrote:

> Hi gang,  
> I have a buttload of logs across a buttload of servers. I am NOT talking  
> web logs. I am talking about misc log files on U/Linux systems. Error logs,  
> security logs, access logs, _sometimes_ a web log, and other misc system  
> message logs. I want to use Elasticsearch for ALL my logs everywhere.  
> I assume this is what ES does and can easily handle it. Question is, how  
> do I point my logs from multiple systems to ES? For example, how would I  
> point /var/messages on machine A to ES running on machine B?

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![Clinton\_Gormley](https://avatars.discourse-cdn.com/v4/letter/c/50afbb/32.png) [@Clinton\_Gormley](https://discuss.elastic.co/u/Clinton_Gormley)
#### Post date: [February 25, 2013, 8:29pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887/4 "2013-02-25T20:29:39Z")

</div>

On Mon, 2013-02-25 at 09:21 -0800, Justin Franks wrote:

> Hi gang,  
> I have a buttload of logs across a buttload of servers. I am NOT  
> talking web logs. I am talking about misc log files on U/Linux  
> systems. Error logs, security logs, access logs, _sometimes_ a web  
> log, and other misc system message logs. I want to use Elasticsearch  
> for ALL my logs everywhere.  
> I assume this is what ES does and can easily handle it. Question is,  
> how do I point my logs from multiple systems to ES? For example, how  
> would I point /var/messages on machine A to ES running on machine B?

Have a look at logstash

> **[Logstash: Collect, Parse, Transform Logs | Elastic](https://www.elastic.co/logstash)**
>
> Logstash (part of the Elastic Stack) integrates data from any source, in any format with this flexible, open source collection, parsing, and enrichment pipeline. Download for free.

clint

--  
You received this message because you are subscribed to the Google Groups "elasticsearch" group.  
To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com).  
For more options, visit [https://groups.google.com/groups/opt\_out](https://groups.google.com/groups/opt_out).

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 2:49am UTC](https://discuss.elastic.co/t/using-elasticsearch-for-non-weblogs/10887/5 "2017-07-06T02:49:37Z")

</div>


