# How to install Filebeat? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 14, 2015, 7:17am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094 "2015-12-14T07:17:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Post date:** [December 14, 2015, 7:17am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/1 "2015-12-14T07:17:45Z")
We have two gcloud instances and we need to collect logs of those two instances using filebeat and we have another instance to store the logs and to analyze by kibana ,elasticsearch and [logstash.My](http://logstash.My) question can you tell me what to install on these instances to work with Filebeat. Thanks in advance, Kartheek Gummaluri ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 14, 2015, 7:25am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/2 "2015-12-14T07:25:26Z")
Have you seen the documentation? [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-getting-started.html) ---
**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Post date:** [December 14, 2015, 7:26am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/3 "2015-12-14T07:26:26Z")
yes but there two plugins right I was confused where to install filebeat-input plugin and filebeat plugin. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 14, 2015, 7:35am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/4 "2015-12-14T07:35:09Z")
Okay, so you're really asking about Logstash. What version of Logstash are you using? Recent versions have the beats input plugin out of the box so you don't need to install anything extra. ---
**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Post date:** [December 14, 2015, 7:36am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/5 "2015-12-14T07:36:30Z")
logstash-1.5.6 ---
**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Post date:** [December 14, 2015, 7:40am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/6 "2015-12-14T07:40:20Z")
Why I am using logstash means if we need to query the message field and message field is analyzed. And do you suggest the below mentioned query i did is right one or [not.So](http://not.So) that I can able to query the message fileds. input { file { path =\> "/var/tmp/querylogs.log" start\_position =\> beginning } } filter { grok { match =\> { "message"} } } output { elasticsearch { protocol =\> "http" } stdout {} } output { elasticsearch { index =\> "querylogs" index\_type =\> "logs" } stdout {} } ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 14, 2015, 7:44am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/7 "2015-12-14T07:44:14Z")
Follow the [plugin installation documentation](https://www.elastic.co/guide/en/logstash/1.5/working-with-plugins.html) to install logstash-input-beats. If that doesn't work it might be because the beats in put requires Logstash 2.x but I don't think it does. Unless you have any particular reason to stay on Logstash 1.5.x I'd recommend that you upgrade. Looking at your Logstash configuration, your grok filter doesn't do anything. If you want to parse a message you have to tell Logstash how that should be done. See examples in the documentation. Also, you have two elasticsearch output and two stdout outputs. That hardly makes sense. ---
**Author:** ![kartheek91](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Post date:** [December 14, 2015, 7:54am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/8 "2015-12-14T07:54:09Z")
I was mentioned in previous statements that we have two instances so I need to filebeat on both the instances [right.Is](http://right.Is) there any possibility that if we output to elastisearch.How to do message field to un-analyzed so that searching can be done. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [December 14, 2015, 8:28am UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/9 "2015-12-14T08:28:17Z")
> I was mentioned in previous statements that we have two instances so I need to filebeat on both the instances right Yes. > How to do message field to un-analyzed so that searching can be done. With the default mappings configured by the index template that ships with Logstash, all string fields have a .raw subfield containing an unanalyzed copy of the field. You can confirm that you can perform the searches you want using those fields. To skip the .raw subfield and make the field itself unanalyzed, make a copy of the index template, modify it, and configure Logstash to use it. This was discussed in a thread in the Logstash group just a few days ago. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/how-to-install-filebeat/37094/10 "2017-07-05T21:57:31Z")