# Benefits of Metricbeat direct to ES vs Metricbeat Logstash?

**URL:** https://discuss.elastic.co/t/benefits-of-metricbeat-direct-to-es-vs-metricbeat-logstash/366514
**Category:** Beats
**Tags:** metricbeat
**Created:** [September 13, 2024, 7:23am UTC](https://discuss.elastic.co/t/benefits-of-metricbeat-direct-to-es-vs-metricbeat-logstash/366514 "2024-09-13T07:23:10Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![randomnamegenerator](https://avatars.discourse-cdn.com/v4/letter/r/7ab992/32.png) [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [September 13, 2024, 7:23am UTC](https://discuss.elastic.co/t/benefits-of-metricbeat-direct-to-es-vs-metricbeat-logstash/366514/1 "2024-09-13T07:23:10Z")

</div>

Hello

We are looking into installing Metricbeat on 8 customer application servers to get a better overview of what is happening regarding cpu,memory etc usage. At this stage we would only be using system and windows modules

Currently we have ELK setup with filebeat sending application logs from those same 8 application servers and it runs well for the most part.

In this environment/scenario is there any benefit to using sending metricbeat data to logstash rather than sending direct to elasticsearch ?

Thanks in advance

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [September 14, 2024, 9:26pm UTC](https://discuss.elastic.co/t/benefits-of-metricbeat-direct-to-es-vs-metricbeat-logstash/366514/2 "2024-09-14T21:26:26Z")

</div>

Hi @randomnamegenerator

If you look at this and just replace agent with metricbeat beat it will give you some insight.

> **[Ingest architectures | Elastic Ingest Reference Architectures \[8.15\] | Elastic](https://www.elastic.co/guide/en/ingest/current/use-case-arch.html)**

But in short if you are doing just basic metrics.. putting logstash in the middle is mostly about single egress point and perhaps queuing...

Metrics tend to have a pretty constant rate so queueing is more about if Elasticsearch is unavailable.

Metricbeat straight to Elasticsearch is a perfectly fine architecture as well

---

<div class="post-metadata">

### Author: ![randomnamegenerator](https://avatars.discourse-cdn.com/v4/letter/r/7ab992/32.png) [@randomnamegenerator](https://discuss.elastic.co/u/randomnamegenerator)
#### Post date: [November 8, 2024, 9:26am UTC](https://discuss.elastic.co/t/benefits-of-metricbeat-direct-to-es-vs-metricbeat-logstash/366514/3 "2024-11-08T09:26:15Z")

</div>

Thanks for the reply
