Some notes from my side here:
- There is no clear criteria when to use filebeat on the client side and when to install full logstash. In general it can be said that filebeat uses much less resources then logstash but as always it depends on the setup etc. I can't give you a specific ratio.
- It is not intended that Beats replace logstash, as one of the key criterias is to keep them as lightweight as possible. The impact of running one or multiple beats inside all your severs inside your server farm should be as minimal as possible. For things like grok and data transformation you will still need Logstash.
- What is the main reason you are using redis and not filebeat -> LS -> ES? I know there are different reasons for this setup but it would be nice to hear what the reason is for you. Filebeat supports sending data to multiple LS instances for load balancing and guarantees at least once delivering.