# Problem understanding the concept of filebeat -\> logstash
**URL:** https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230
**Category:** Logstash
**Created:** [October 25, 2017, 11:16am UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230 "2017-10-25T11:16:55Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@sd2j](https://discuss.elastic.co/u/sd2j)
#### Post date: [October 25, 2017, 11:16am UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/1 "2017-10-25T11:16:55Z")
Well I got everything running .. at least partially. I am able to get logs from filebeat -\> logstash -\> elastic -\> kibana
I have to admit i haven't read all documentation - which is way to much for my short time. But I seem to have an understanding problem.
I am using logstash as an "connection point". It receives data on a port and pushes it to elasticsearch - I am aware that filebeat is able to push directly to elastic but if there is a untypical log file created by software i can create a regex pattern by using a logstash filter combined with an IF condition - that's the reason for using logstash?!
But with this configuration it seems that filebeat is pushing the logs as plain text - I've thought that it is using templates and is working for most default log files - apache, syslog etc.
@timestamp: October 25th 2017, 13:05:45.611 offset: 96,200 @version: 1 beatname: testing\_server beat.hostname: debian beat.version: 5.6.3 input\_type: log host:debian
source: /var/log/daemon.log message: **Oct 25 06:05:43 debian apachectl[913]: AH00558: apache2:** Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
type: logtags: beats\_input\_codec\_plain\_applied\_id: AV9TNZefwb4CR4YbNQRC\_type: log\_index: filebeat-2017.10.25\_score: -
Should be the bold part be parsed and not be within the message ?
What am I overlooking or am I completely wrong ?
PS: I will create another Topic later but maybe it is a very short answer.
Can i change the order of the tags in kibana? I prefer that the "message" is in a single/last line - which would make it easier to read?
Thanks!
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 25, 2017, 12:16pm UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/2 "2017-10-25T12:16:37Z")
> I am aware that filebeat is able to push directly to elastic but if there is a untypical log file created by software i can create a regex pattern by using a logstash filter combined with an IF condition - that's the reason for using logstash?!
Yes, Logstash has richer features for parsing and processing logs.
> Should be the bold part be parsed and not be within the message ?
Yes, the bold part should be chopped into separate fields. Getting that done is a typical use case for Logstash but recent Filebeat releases have a modules feature that might perform the same task. Unless you've enabled the right module Filebeat ships raw unparsed files.
> Can i change the order of the tags in kibana?
I don't think so.
---
### Author:  [@sd2j](https://discuss.elastic.co/u/sd2j)
#### Post date: [October 26, 2017, 2:11pm UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/3 "2017-10-26T14:11:28Z")
Thanks for the information.
While searching for these modules I've found: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-template.html)
So it it not compatible with logstash, right?
Thanks
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 26, 2017, 3:13pm UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/4 "2017-10-26T15:13:40Z")
Compatible in what sense?
---
### Author:  [@sd2j](https://discuss.elastic.co/u/sd2j)
#### Post date: [October 26, 2017, 3:17pm UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/5 "2017-10-26T15:17:12Z")
"By default, Filebeat automatically loads the recommended template file, filebeat.template.json, if Elasticsearch output is enabled."
So the automatic parsing is only possible when filebeat -\> elasticsearch is used and not filebeat -\>logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [October 26, 2017, 3:26pm UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/6 "2017-10-26T15:26:11Z")
According to [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html) you won't be able to use Filebeat modules together with Logstash.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 23, 2017, 3:26pm UTC](https://discuss.elastic.co/t/problem-understanding-the-concept-of-filebeat-logstash/105230/7 "2017-11-23T15:26:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.