Logs transfer thru Filebeat to Logstash

[ashurawat (Ashu)]

Please suggest the best technique to be used while sending the data thru filebeat to logstash

1. Filebeat directly sending the data to logstash
2. Filebeat should send the data to REDIS/KAFKA and then from their logstash is reading it.

Please suggest with advantages and disadvantages of both.

Thanks

[andrewkroh]

There isn't one "best technique" as it depends a lot on your requirements and architecture. There are some existing blog posts discussing queueing and I've linked them below.

Also take a look at using the persistent queue feature that's part of the Logstash as an alternative to putting a queue between Beat and Logstash.

Blogs

• https://www.elastic.co/blog/logstash-persistent-queue
• https://www.elastic.co/blog/just-enough-kafka-for-the-elastic-stack-part1
• https://www.elastic.co/blog/just-enough-kafka-for-the-elastic-stack-part2

[ashurawat (Ashu)]

Thank you so much Andrew. I will surely try those.