# When and how are logs transformed the elastic-agent collects

**URL:** <https://discuss.elastic.co/t/when-and-how-are-logs-transformed-the-elastic-agent-collects/359751>\
**Category:** Elastic Agent\
**Created:** [May 18, 2024, 2:16pm UTC](https://discuss.elastic.co/t/when-and-how-are-logs-transformed-the-elastic-agent-collects/359751 "2024-05-18T14:16:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fbr](https://avatars.discourse-cdn.com/v4/letter/f/85f322/32.png) [@fbr](https://discuss.elastic.co/u/fbr)\
**Post date:** [May 18, 2024, 2:16pm UTC](https://discuss.elastic.co/t/when-and-how-are-logs-transformed-the-elastic-agent-collects/359751/1 "2024-05-18T14:16:49Z")

</div>

Hi there,  
we are running multiple web-applications (symfony) distributed over multiple server. Now we want to have a centralized place for the logs.  
I've set up the ELK-Stack (OK, to be honest... i've registered an cloud-account 😉)  
As far as i've seen, the way to go is to run either elastic agents on the different servers or log to rabbit-mq.  
Now.. the elastic agent is running, reads the log-files and pushes it to ELK ✅  
What i am struggling with is where i have to interpret and transform the log-files. My application (monolog) would be able to write the log-files formatted as "logstash" or "gelf" (beside other formats)  
Whats the way to go?  
(a) write to files or (b) write to rabbitMq  
let my application write a specific format? if yes, which one and who is responsible for interpreting (elastic-agent or someone afterwards?)  
thanks!