title: Elasticsearch - Collecting logs from devices not on server LAN
body: <p>I am trying to build familiarity with SIEM systems in general and decided to set up an Elastic Stack via Digital Ocean. Everything was successful and my server as localhost is producing logs. It's been interesting to tinker with visualizations and that good stuff.</p>
  <p>Obviously my interest isn't in logs from this remote server, though. I would like to configure some devices on my home network to send logs.</p>
  <p>Current setup on server: filebeat &gt; logstash &gt; elasticsearch &gt; kibana.</p>
  <p>When I install filebeat onto, say, my laptop and configure the .yml file in a similar way to the server (comment out elastic output, uncomment logstash output) it is not able to connect. Basically I just set the hosts to <em>serverip:logstash port</em> and enabled filebeat on the system. Running the setup commands leads to a &quot;couldn't connect to any configured elasticsearch hosts&quot;.</p>
  <p>Instead of a direct answer, can someone explain for me generally what I need to be considering for this process? What is happening when connecting outside of the server LAN? and how do I handle authentication to the server, if needed?</p>
  <p>Thank you, really. I know that the information is out there but I am deep in a rabbit hole and having a hard time finding what I need.</p>