At present, we have ELK stack running on Ubuntu and filebeat on windows to collect logs from different applications running on it. If we want to send logs directly to logstash instead of using filebeat as data shipper, Do we need to install logstash on each windows machine to capture the logs or is it possible to write directly to the centralised logstash pipeline ?
I read about logstash forwarder as a data shipper and its been replaced by Beats(light weight shipper). But I need help on choosing the right solution to our environment. With filebeat, we need to add manually some custom fields which we think can be exported by the application/service itself. For example - service name, service version, app id etc.