I use Elastic Stack to centralize logs from Java web applications. Logs are based on Sfl4j+Logback so I've used Logback JSON encoder. I've setup two possible solutions:
- LogstashTcpSocketAppender: messages are directly shipped to Logstash (without Filebeat)
- FileAppender to output JSON structured messages: Filebeat parses json log files and sends them to Logstash. In this case, Logstash needs an aditional filter to parse json objects.
The first option seems to be simpler but the second option allows offline parsing. What's the best practice in this scenario?
Thanks very much