# Filebeats to Elasticsearch directly?

**URL:** <https://discuss.elastic.co/t/filebeats-to-elasticsearch-directly/194477>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 8, 2019, 5:04pm UTC](https://discuss.elastic.co/t/filebeats-to-elasticsearch-directly/194477 "2019-08-08T17:04:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![cybercorp](https://avatars.discourse-cdn.com/v4/letter/c/eb9ed0/32.png) [@cybercorp](https://discuss.elastic.co/u/cybercorp)\
**Post date:** [August 8, 2019, 5:04pm UTC](https://discuss.elastic.co/t/filebeats-to-elasticsearch-directly/194477/1 "2019-08-08T17:04:05Z")

</div>

Hello

Filebeats seems to have many modules available like system, apache, and others. Since modules are responsible for parsing the data, if I send data directly from Filebeats to ES, will those logs supported by modules be parsed?

I have been trying this setup however the system logs (/var/log/secure and others) do not seem to be parsed even though I have enabled the system module of filebeat within the Linux instance.

Wanted to know if this is the right setup or do we need to add an additional logstash to parse the logs?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [August 8, 2019, 7:59pm UTC](https://discuss.elastic.co/t/filebeats-to-elasticsearch-directly/194477/2 "2019-08-08T19:59:56Z")

</div>

No, Filebeat modules only work with ES, as logs are parsed by Ingest pipelines. Have you loaded those? Could you please share a few example input logs, events seen in Kibana and the debug logs of Filebeat?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 5, 2019, 8:12pm UTC](https://discuss.elastic.co/t/filebeats-to-elasticsearch-directly/194477/3 "2019-09-05T20:12:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
