How to parse Apache log : Logstash plugin or Filebeat module?

Elastic Stack Logstash
1

I'm in troubles using ELK stack for analysing my Apache's logs.

Is it better to parse them with Filebeat using the Apache's module directly shipping to Elasticsearch ?
Or it's better to use grok plugin from Logstash for the Apache's log ?
Which way is the best and why ?

2

Hi @Paul_ALTEN and welcome :slight_smile:

I'd recommend you to use Filebeat module for Apache, shipping directly to Elasticsearch. The filebeat module includes an ingest pipeline with everything needed to parse Apache logs, this pipeline makes use of the grok ingest processor in Elasticsearch, that is very similar to the Logstash one you mention.

Why is it better? With this option you don't need to maintain Logstash as an additional piece in your infrastructure, and you don't need to implement your own pipeline to parse logs, because it is already provided by the Filebeat module.

3

You can convert the elasticsearch ingest pipelines to logstash format: https://www.elastic.co/guide/en/logstash/7.2/ingest-converter.html

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.