# Filebeat's module using Logstash
**URL:** https://discuss.elastic.co/t/filebeats-module-using-logstash/106049
**Category:** Beats
**Tags:** filebeat
**Created:** [November 1, 2017, 3:01pm UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049 "2017-11-01T15:01:00Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Elezium](https://discuss.elastic.co/u/Elezium)
#### Post date: [November 1, 2017, 3:01pm UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/1 "2017-11-01T15:01:01Z")
Hi,
I'm facing issue with Filebeat's module and Logstash,
If I use FileBeat and set the output to Elastic Search, everything seems to run fine. But if I output to LogStash, I do see the data in Elasticsearch but they doesn't seems to be "tagged" properly and the information doesn't appears in the Dashboard.
Here's my config file:
filebeat.yml
> ```
> filebeat.modules:
> - module: system
> - module: auditd
>
> #output.elasticsearch:
> # Array of hosts to connect to.
> # hosts: ["localhost:9200"]
>
> output.logstash:
> # The Logstash hosts
> hosts: ["localhost:5044"]
>
> ```
logstash.conf
> ```
> input {
> beats {
> port => 5044
> }
> }
> # The filter part of this file is commented out to indicate that it is
> # optional.
> # filter {
> #
> # }
> output {
> elasticsearch {
> hosts => localhost
> manage_template => false
> index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> document_type => "%{[@metadata][type]}"
> }
> }
>
> ```
I've try to use ES output first, and then swtich to Logstash, but same issue, the data doesn't appears to be "tagged" properly. I've read the documentation and I've try the -setup -E switch, like so:
` /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/fileBeat -e -modules=system -setup -E "output.elasticsearch.hosts=["http://localhost:9200"]"`
That seems to connect to ES first, and then use Logstash but it seems a bit hackish.
Does the Filebeat modules support Logstash or we should use ES directly?
Sorry if it's not totally clear, pretty new to ELK.
Thanks.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 1, 2017, 6:56pm UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/2 "2017-11-01T18:56:27Z")
Currently FB modules only work when sending directly to Elasticsearch (because they use Ingest Node). The [docs](https://www.elastic.co/guide/en/logstash/5.6/filebeat-modules.html) provide good overview on this.
---
### Author:  [@Elezium](https://discuss.elastic.co/u/Elezium)
#### Post date: [November 1, 2017, 7:33pm UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/3 "2017-11-01T19:33:11Z")
Thanks.
To use LogStash, I would have to write own pipeline, correct?
---
### Author:  [@pierhugues](https://discuss.elastic.co/u/pierhugues)
#### Post date: [November 1, 2017, 7:39pm UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/4 "2017-11-01T19:39:28Z")
@Elezium Correct, you can also use the `ingest-convert` which is shipped with Logstash to help you with the transition. See this [blog post](https://www.elastic.co/blog/ingest-node-to-logstash-configuration-converter) for more details
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 1, 2017, 9:12pm UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/5 "2017-11-01T21:12:31Z")
Also here are docs for the ingest-converter: [https://www.elastic.co/guide/en/logstash/5.6/ingest-converter.html](https://www.elastic.co/guide/en/logstash/5.6/ingest-converter.html)
The auditd module won't convert nicely because it uses a painless script to parse the data. Anyways I would recommend using [Auditbeat](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-metricset-audit-kernel.html) to collect this data if possible.
---
### Author:  [@Elezium](https://discuss.elastic.co/u/Elezium)
#### Post date: [November 2, 2017, 2:11am UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/6 "2017-11-02T02:11:42Z")
Thanks both @pierhugues and @andrewkroh .
We setup FileBeat using ES directly, so far so good.
Appreciate your time.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 30, 2017, 2:12am UTC](https://discuss.elastic.co/t/filebeats-module-using-logstash/106049/7 "2017-11-30T02:12:18Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.