# Filebeat and Logstash

**URL:** <https://discuss.elastic.co/t/filebeat-and-logstash/74942>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 13, 2017, 11:30pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/74942 "2017-02-13T23:30:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mattgolding](https://avatars.discourse-cdn.com/v4/letter/m/848f3c/32.png) [@mattgolding](https://discuss.elastic.co/u/mattgolding)\
**Post date:** [February 13, 2017, 11:30pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash/74942/1 "2017-02-13T23:30:54Z")

</div>

I have a question around the interaction between filebeat and logstash. I have read that filebeat will slow down if logstash is under the pump a little. My question is what happens if logstash goes down or I turn it off? Does filebeat know that logstash didn't receive the entries? Does it try and resend the entries?

Also just to ensure I understand the reason to use a Filebeat. My understanding is it is just more lightweight than running a logstash instance on that machine?

Thanks  
Matt

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 14, 2017, 6:52am UTC](https://discuss.elastic.co/t/filebeat-and-logstash/74942/2 "2017-02-14T06:52:01Z")

</div>

> My question is what happens if logstash goes down or I turn it off? Does filebeat know that logstash didn't receive the entries?

Yes.

> Does it try and resend the entries?

Yes.

> Also just to ensure I understand the reason to use a Filebeat. My understanding is it is just more lightweight than running a logstash instance on that machine?

Yes, that's the main reason.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2017, 6:52am UTC](https://discuss.elastic.co/t/filebeat-and-logstash/74942/3 "2017-03-14T06:52:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.