Can we omit filter in this case?

Elastic Stack Logstash
1

Hi Guys,

If I am accepting input over beats can I completely omit filter? I mean just input { beats port 5044} and then output {
elasticsearch {
hosts => [192.168.1.12"9200"]
}
}

2

What beat(s) are you using?

3

I am using filebeat & Packetbeats

4

You can for packetbeat. Filebeat will depend on what format the source logs are in.

5

I see but are they not already parsing the logs before being sent?

6

No, filebeat does no parsing, it just ships.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.