forward to file & elasticsearch