title: Logstash shipper & server on the same box
body: <p>I'm trying to setup a central logstash configuration. However I would like to be sending my logs through syslog-ng and not third party shippers. This means that my logstash server is accepting via syslog-ng all the logs from the agents.</p>
  
  <p>I then need to install a logstash process that will be reading from /var/log/syslog-clients/* and grabbing all the log files that are sent to the central log server. These logs will then be sent to redis on the same VM.</p>
  
  <p>In theory I need to also configure a second logstash process that will read from redis and start indexing the logs and send them to elasticsearch.</p>
  
  <p>My question:</p>
  
  <p>Do I have to use two different logstash processes (shipper &amp; server) even if I am in the same box (I want one log server instance)? Is there any way to just have one logstash configuration and have the process read from syslog-ng ---> write to redis and also read from redis ---> output to elastic search ?</p>
  
  <p>Diagram of my setup:</p>
  
  <p>[client]-------syslog-ng---> [log server] ---syslog-ng &lt;----logstash-shipper ---> redis &lt;----logstash-server ----> elastic-search &lt;--- kibana</p>