# Filebeat and Logstash

**URL:** https://discuss.elastic.co/t/filebeat-and-logstash/263873
**Category:** Beats
**Tags:** filebeat
**Created:** [February 10, 2021, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873 "2021-02-10T12:58:38Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)
#### Post date: [February 10, 2021, 12:58pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873/1 "2021-02-10T12:58:38Z")

</div>

Hi,

1. I'd like to install Filebeat and send the Filebeat output to logstash,  
Is this documentation is relevant also to the latest version? [Step 3: Configure Filebeat to use Logstash | Filebeat Reference [6.8] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/6.8/config-filebeat-logstash.html)

2. Does it make sense to install the Filebeat on the logstash server?  
I have an EC2 server with 4CPU, 16GB memory (CPU utilization is no more than 15%).

Thank you!

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [February 10, 2021, 1:02pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873/2 "2021-02-10T13:02:25Z")

</div>

1. Here is the [current documentation](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html) if you wanted to compare.

2. I would put Filebeat on the server where you want to collect the logs. That's really the only determining factor (for the majority of use cases).

---

<div class="post-metadata">

### Author: ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)
#### Post date: [February 10, 2021, 1:12pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873/3 "2021-02-10T13:12:33Z")

</div>

Hi 🙂

1. Thanks for the updated documentation.
2. So basically it shouldn't affect the performance if I'd configure it on the Logstash server?  
My purpose is to use the Filebeat Palo Alto Networks module and then use the Logstash.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [February 10, 2021, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873/4 "2021-02-10T13:16:45Z")

</div>

> [@Sunflower](#):
>
> So basically it shouldn't affect the performance if I'd configure it on the Logstash server?

It depends on how much data is going to be processed and if Logstash is being used for other data ingestion pipelines.

I would recommend putting it on the Logstash server and testing.

---

<div class="post-metadata">

### Author: ![Sunflower](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Sunflower](https://discuss.elastic.co/u/Sunflower)
#### Post date: [February 10, 2021, 1:20pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873/5 "2021-02-10T13:20:34Z")

</div>

Got it, for now the Logstash is handling the data that should be used in the Filebeat module  
I guess I should test it anyway 🙂 Thank you!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 10, 2021, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/263873/6 "2021-03-10T15:21:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
