Filebeat and Logstash

[Sunflower]

Hi,

1. I'd like to install Filebeat and send the Filebeat output to logstash,
   Is this documentation is relevant also to the latest version? Step 3: Configure Filebeat to use Logstash | Filebeat Reference [6.8] | Elastic

2. Does it make sense to install the Filebeat on the logstash server?
   I have an EC2 server with 4CPU, 16GB memory (CPU utilization is no more than 15%).

Thank you!

[aaron-nimocks]

1. Here is the current documentation if you wanted to compare.

2. I would put Filebeat on the server where you want to collect the logs. That's really the only determining factor (for the majority of use cases).

[Sunflower]

Hi

1. Thanks for the updated documentation.
2. So basically it shouldn't affect the performance if I'd configure it on the Logstash server?
   My purpose is to use the Filebeat Palo Alto Networks module and then use the Logstash.

[aaron-nimocks]

@Sunflower

So basically it shouldn't affect the performance if I'd configure it on the Logstash server?

It depends on how much data is going to be processed and if Logstash is being used for other data ingestion pipelines.

I would recommend putting it on the Logstash server and testing.

[Sunflower]

Got it, for now the Logstash is handling the data that should be used in the Filebeat module
I guess I should test it anyway Thank you!