# Send Local Logs to Filebeat

**Scenario:** You want to save gateway/relay logs to Filebeat. This guide presents a simple method to automatically send all gateway/relay logs to Filebeat, which is a common ingestion tool for solutions like ElasticSearch.

{% hint style="info" %}
As with all gateway/relay logs, the logs stored on the gateway/relay will not include Admin UI activities, which can be accessed via the `sdm audit activities` command.
{% endhint %}

### Setting up the export

1. Enable relay logging in the Admin UI under *Settings / Log Encryption & Storage*. Ensure logging is set to FILE.
2. Use [these instructions](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html) to install the Filebeat client on each gateway or relay.
3. Create a [manual input configuration](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html) that looks like the following:

   ```yml
   paths:
       - /home/sdm/.sdm/logs/*.log
   include_lines: ['uuid\":\"0']
   ```
4. Modify the second line to use the absolute path to the SDM logs on your machine.
5. The `include_lines` entry parses the log format to include the uuid (the unique id for each log event) and events of type "0", which are database queries.
6. You can omit the `include_lines` entry if you would like to capture all events.