LSF has been deprecated in favour of Filebeat

The Logstash Forwarder is being retired and replaced with Filebeat.


Filebeat has improved functionality, including the ability to ship to multiple different outputs such as directly to Elasticsearch or to Logstash, both with optional TLS/SSL. It also comes with its own Logstash input plugin which uses the existing Lumberjack protocol.

Future improvements for Filebeat include multiline support and field filtering.

We also have a Filebeat category for any questions you may have, so please be sure to check it out.

This topic is now a banner. It will appear at the top of every page until it is dismissed by the user.

This topic is no longer a banner. It will no longer appear at the top of every page.