Hi! It sounds like you have it backwards: Filebeat can send to Logstash and / or Elasticsearch, but Logstash cannot send to Filebeat. If you install Filebeat on the same server as your nginx logs, you can forward them directly to Elasticsearch, or run them through Logstash first, but once they're in Logstash they don't need to go back to Filebeat.
1 Like