# Logstash vs Filebeat Output Logs

**URL:** <https://discuss.elastic.co/t/logstash-vs-filebeat-output-logs/122904>\
**Category:** Logstash\
**Created:** [March 7, 2018, 2:52pm UTC](https://discuss.elastic.co/t/logstash-vs-filebeat-output-logs/122904 "2018-03-07T14:52:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rickyrome86](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rickyrome86](https://discuss.elastic.co/u/rickyrome86)\
**Post date:** [March 7, 2018, 2:52pm UTC](https://discuss.elastic.co/t/logstash-vs-filebeat-output-logs/122904/1 "2018-03-07T14:52:19Z")

</div>

What is the best method to send logs to another environment? We are currently sending logs internally via log-stash to our elastic search, but would like to send the logs to another environment managed by a 3rd party. I had the below setup in our test environment (logstash config file), but it seems to not be consistent in what i can see in elastic search in both consoles. Can we send the logs directly from file-beat instead? If so what is the configuration look like? I cant seem to find anything supporting this.

}  
output {  
if [type] == "output" {  
elasticsearch {  
hosts =\> ["10.204.0.203:9200"]  
index =\> "wazuh-alerts-3.x-%{+YYYY.MM.dd}"  
}

```
elasticsearch {
  hosts => ["192.168.2.227:9200"]
  index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
}

```

}  
}

---

<div class="post-metadata">

**Author:** ![tag\_v](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tag_v/32/47466_2.png) [@tag\_v](https://discuss.elastic.co/u/tag_v)\
**Post date:** [March 7, 2018, 6:51pm UTC](https://discuss.elastic.co/t/logstash-vs-filebeat-output-logs/122904/2 "2018-03-07T18:51:13Z")

</div>

> [@rickyrome86](#):
>
> What is the best method to send logs to another environment?

whats other environment here? does that mean elasticsearch at 3rd party network? If thats the scenario yes we can simply mentioning hostname:portnumber where es is running and mention certs if any.

> [@rickyrome86](#):
>
> Can we send the logs directly from file-beat instead? If so what is the configuration look like?

If you dont have requirement of parsing logs, ya you can directly push logs from filebeat to elasticsearch. enable output.elasticsearch in filebeat with respective "[hostname:portnumber]".

---

<div class="post-metadata">

**Author:** ![rickyrome86](https://avatars.discourse-cdn.com/v4/letter/r/e47774/32.png) [@rickyrome86](https://discuss.elastic.co/u/rickyrome86)\
**Post date:** [March 7, 2018, 7:12pm UTC](https://discuss.elastic.co/t/logstash-vs-filebeat-output-logs/122904/3 "2018-03-07T19:12:33Z")

</div>

Yes the 3rd party is running Elasticsearch. I have the below configuration but no logs are showing up. Does that look correct?

# Wazuh - Logstash configuration file

## Remote Wazuh Manager - Filebeat input

input {  
beats {  
port =\> 5000  
codec =\> "json\_lines"

# ssl =\> true

# ssl\_certificate =\> "/etc/logstash/logstash.crt"

# ssl\_key =\> "/etc/logstash/logstash.key"

```
}

```

}  
filter {  
if [data][srcip] {  
mutate {  
add\_field =\> ["@src\_ip", "%{[data][srcip]}" ]  
}  
}  
if [data][aws][sourceIPAddress] {  
mutate {  
add\_field =\> ["@src\_ip", "%{[data][aws][sourceIPAddress]}" ]  
}  
}  
}  
filter {  
geoip {  
source =\> "@src\_ip"  
target =\> "GeoLocation"  
fields =\> ["city\_name", "continent\_code", "country\_code2", "country\_name", "region\_name", "location"]  
}  
date {  
match =\> ["timestamp", "ISO8601"]  
target =\> "@timestamp"  
}  
mutate {  
remove\_field =\> ["timestamp", "beat", "input\_type", "tags", "count", "@version", "log", "offset", "type","@src\_ip"]  
}  
}  
output {  
if [type] == "output" {  
elasticsearch {  
hosts =\> ["[http://10.204.0.203:9200](http://10.204.0.203:9200)"]  
index =\> "wazuh-alerts-3.x-%{+YYYY.MM.dd}"  
}

```
elasticsearch {
  hosts => ["http://192.168.7.227:9200"]
  index => "wazuh-alerts-3.x-%{+YYYY.MM.dd}"
}

```

}  
}

We also may want to directly output to the 3rd party from filebeat, below is the configuration. Simply add like this? hosts: ["logstash:5000", "logstash2:5000"]

filebeat:  
prospectors:

- input\_type: log  
paths:
  - "/var/ossec/data/logs/alerts/alerts.json"  
document\_type: wazuh-alerts  
json.message\_key: log  
json.keys\_under\_root: true  
json.overwrite\_keys: true

output:  
logstash:

# The Logstash hosts

hosts: ["logstash:5000"]

# ssl:

# certificate\_authorities: ["/etc/filebeat/logstash.crt"]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2018, 7:12pm UTC](https://discuss.elastic.co/t/logstash-vs-filebeat-output-logs/122904/4 "2018-04-04T19:12:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.