# Beats to Elasticsearch or Beats to Logstash? Which is best practice

**URL:** https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594
**Category:** Beats
**Tags:** filebeat
**Created:** [March 12, 2018, 4:15pm UTC](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594 "2018-03-12T16:15:57Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![RayS](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rays/32/28268_2.png) [@RayS](https://discuss.elastic.co/u/RayS)
#### Post date: [March 12, 2018, 4:15pm UTC](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594/1 "2018-03-12T16:15:57Z")

</div>

Is it better to send all beats data to logstash or send it directly to elasticsearch? I'm in the process of engineering my setup here and was wonder what is considered best practice?

---

<div class="post-metadata">

### Author: ![yodog](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yodog/32/4822_2.png) [@yodog](https://discuss.elastic.co/u/yodog)
#### Post date: [March 12, 2018, 5:48pm UTC](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594/2 "2018-03-12T17:48:31Z")

</div>

i always had logstash parsing the log messages before sending to elasticsearch.

now im testing a setup with two instances, where filebeat native modules (like apache) send to elasticsearch, and others (like cyrus, postfix) send to logstash for processing.

i'm thinking about converting my logstash parse rules to filebeat modules, but that would take some time...

---

<div class="post-metadata">

### Author: ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [March 13, 2018, 8:41am UTC](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594/3 "2018-03-13T08:41:01Z")

</div>

It depends on what feature set you need. Logstash is much more powerful in processing data then the ingest pipeline is and for example has outputs and a local queue. If you only need to features which are provided by Filebeat + ES I would recommend the simpler setup.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 10, 2018, 8:41am UTC](https://discuss.elastic.co/t/beats-to-elasticsearch-or-beats-to-logstash-which-is-best-practice/123594/4 "2018-04-10T08:41:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.