# Elasticsearch input **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [December 14, 2018, 3:05pm UTC](https://community.graylog.org/t/elasticsearch-input/8038 "2018-12-14T15:05:43Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\ **Post date:** [December 14, 2018, 3:05pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/1 "2018-12-14T15:05:43Z")
Hi, I have a new ElasticSearch and I need to send data from Elastic to Graylog. Is there a simple way to connect them? Thanks Gianluca ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [December 14, 2018, 8:20pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/2 "2018-12-14T20:20:20Z")
Do you want to send the Elasticsearch’s log to graylog? In this case you can use rsyslog to read elasticsearch’s log, remove javas new line characters, and send it to graylog via syslog protocol. important lines: ```auto #remove local3.none from messages log *.info;mail.none;authpriv.none;cron.none;local3.none /var/log/messages $ModLoad imfile input(type="imfile" file="/var/log/elasticsearch/asp_kod_elasticsearch.log" escapelf="on" readMode="2" tag="elasticsearch.log" facility="local3") *.* @@IP:514 ``` ---
**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\ **Post date:** [December 14, 2018, 8:35pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/3 "2018-12-14T20:35:24Z")
Thanks for your help. Currently I have an elastic search with a lot of data and I need to move them using graylog So, I’d like to know if there is a way or an input that I can use to connect it. Is there in your opinion a simple way to perform this operation? Thanks Gianluca ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 14, 2018, 8:52pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/4 "2018-12-14T20:52:18Z")
I’m still a bit baffled… Do you want to “_move the data **using** Graylog_” as you say, or do you want to “_move the data **into** Graylog_”? And if you have to move it somewhere, **where** does it need to go and why? You do realize that Graylog’s storage backend **is** ElasticSearch, right? ---
**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\ **Post date:** [December 14, 2018, 9:09pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/5 "2018-12-14T21:09:58Z")
🙂 sure!! A customer has his data stored on an elastic search. Using graylog and a kafka output, I need to move the customer data to kafka. I hope I have explained better my use case and my need. So I need to understand if there is a simple way to extract data from customer elastic search ---
**Author:** ![macko003](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/macko003/32/3175_2.png) [@macko003](https://community.graylog.org/u/macko003)\ **Post date:** [December 14, 2018, 9:12pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/6 "2018-12-14T21:12:38Z")
not so… So you got an elastic database full with graylog’s indices? And you would like to open this data with your graylog? The graylog won’t process stored messages again, so you can’t send it to output via graylog. Maybe you need elasticdump, after that you can do anything with the raw data. ---
**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\ **Post date:** [December 14, 2018, 9:40pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/7 "2018-12-14T21:40:29Z")
> [@gianluca-valentini](#): > > A customer has his data stored on an elastic search. > Using graylog and a kafka output, I need to move the customer data to kafka. > I hope I have explained better my use case and my need. > > So I need to understand if there is a simple way to extract data from customer elastic search Okay a little bit more detail would be nice: what data does the customer have? Graylog indices? Or output from, say, Logstash? In the former case I don’t see what you are trying to do, in the latter case, you can use logstash with an elasticsearch input and a gelf output to re-submit messages to a Graylog instance. ---
**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\ **Post date:** [December 14, 2018, 9:58pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/8 "2018-12-14T21:58:44Z")
we are talking about the second case. Thanks a lot Can you give me an example how to implement this scenario? Can you suggest me a guide to use to implement the elastic search input? Is required an agent installation (like graylog file best for example) in customer environment where elastic is present? ---
**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\ **Post date:** [December 14, 2018, 10:04pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/9 "2018-12-14T22:04:25Z")
Well, we have the same issue - sort of - we migrated from Filebeat -\> Logstash -\> Elasticsearch to using Graylog, and our “old” data still exists on a separate Elasticsearch cluster. What we’re doing now is using Logstash with an Elasticsearch input ([https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-elasticsearch.html)) to read a day at a time (we used daily indices) and submit that via a Gelf output ([https://www.elastic.co/guide/en/logstash/current/plugins-outputs-gelf.html](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-gelf.html)) to Graylog where it’s processed through a pipeline that parses the input and sets the timestamp to the “proper” time. I can’t give you exact implementation details, that depends on the data, the setup they have, how much data there is, how much time you have, and so on and so forth. We also use a huge wad of Perl scripts to orchestrate this stuff, so unfortunately there is no “one size fits all” kind of solution. ---
**Author:** ![gianluca-valentini](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gianluca-valentini/32/1592_2.png) [@gianluca-valentini](https://community.graylog.org/u/gianluca-valentini)\ **Post date:** [December 14, 2018, 10:21pm UTC](https://community.graylog.org/t/elasticsearch-input/8038/10 "2018-12-14T22:21:09Z")
I understand perfectly. First of all thank you for answering me and giving the right instructions to address my scenario. At first sight, it seems that this operation will require a lot of time both for study and implementation. Thanks again ---
**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\ **Post date:** [December 15, 2018, 10:11am UTC](https://community.graylog.org/t/elasticsearch-input/8038/11 "2018-12-15T10:11:36Z")
Good luck Gianluca! Sounds like an exciting project 🙂 Thanks for sharing your experience Ben. ---
**Author:** ![benvanstaveren](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/benvanstaveren/32/3398_2.png) [@benvanstaveren](https://community.graylog.org/u/benvanstaveren)\ **Post date:** [December 15, 2018, 11:11am UTC](https://community.graylog.org/t/elasticsearch-input/8038/12 "2018-12-15T11:11:59Z")
Oh it’ll take a bit of time, unfortunately (well, in our case) logstash isn’t super fast due to the fact our “old” cluster got downsized significantly, so it’s taking time to actually perform the entire thing, but it is doable. It may not be the best way, but it works for our case 🙂 Let us know how it goes! 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [December 29, 2018, 11:12am UTC](https://community.graylog.org/t/elasticsearch-input/8038/13 "2018-12-29T11:12:06Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.