Well. the only thing why I am focusing on Filebeat is just for monitoring the beats and see if there are any events missing while ingesting to Logstash. If Filebeat doesn't parse csv, then I think I should definitely go with the input "file" to parse rather than debugging the errors.