# Logback TCP Appender Vs Filebeat structured logging
**URL:** https://discuss.elastic.co/t/logback-tcp-appender-vs-filebeat-structured-logging/97829
**Category:** Logstash
**Created:** [August 21, 2017, 10:33pm UTC](https://discuss.elastic.co/t/logback-tcp-appender-vs-filebeat-structured-logging/97829 "2017-08-21T22:33:54Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@baldur](https://discuss.elastic.co/u/baldur)
#### Post date: [August 21, 2017, 10:33pm UTC](https://discuss.elastic.co/t/logback-tcp-appender-vs-filebeat-structured-logging/97829/1 "2017-08-21T22:33:54Z")
Hi all,
I use Elastic Stack to centralize logs from Java web applications. Logs are based on Sfl4j+Logback so I've used [Logback JSON encoder](https://github.com/logstash/logstash-logback-encoder/). I've setup two possible solutions:
- LogstashTcpSocketAppender: messages are directly shipped to Logstash (without Filebeat)
- FileAppender to output JSON structured messages: Filebeat parses json log files and sends them to Logstash. In this case, Logstash needs an aditional filter to parse json objects.
The first option seems to be simpler but the second option allows offline parsing. What's the best practice in this scenario?
Thanks very much
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 23, 2017, 8:50pm UTC](https://discuss.elastic.co/t/logback-tcp-appender-vs-filebeat-structured-logging/97829/2 "2017-08-23T20:50:30Z")
I suggest you don't make your application dependent on shipping stuff over the network for logging. Keep things simple and let the application just write the logs to disk.
> Filebeat parses json log files and sends them to Logstash. In this case, Logstash needs an aditional filter to parse json objects.
Or you let Filebeat parse the JSON. Or let Logstash do it via a json codec in the beats input.
---
### Author:  [@baldur](https://discuss.elastic.co/u/baldur)
#### Post date: [August 24, 2017, 8:41pm UTC](https://discuss.elastic.co/t/logback-tcp-appender-vs-filebeat-structured-logging/97829/3 "2017-08-24T20:41:31Z")
OK Magnus, I really appreciate your quick response
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 21, 2017, 8:41pm UTC](https://discuss.elastic.co/t/logback-tcp-appender-vs-filebeat-structured-logging/97829/4 "2017-09-21T20:41:43Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.