# Program for send log from Linux

**URL:** https://discuss.elastic.co/t/program-for-send-log-from-linux/162414
**Category:** Beats
**Created:** [December 29, 2018, 1:36pm UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414 "2018-12-29T13:36:30Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)
#### Post date: [December 29, 2018, 1:36pm UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/1 "2018-12-29T13:36:30Z")

</div>

Hello.  
What is the best program for send Linux log to ELK? I know syslog-ng or rsyslog exist but which program is best and match with ELK?

Thank you.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 29, 2018, 4:05pm UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/2 "2018-12-29T16:05:53Z")

</div>

I think this is filed under the wrong category, so will move it to Beats. Have you looked at [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/index.html)?

---

<div class="post-metadata">

### Author: ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)
#### Post date: [December 29, 2018, 6:47pm UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/3 "2018-12-29T18:47:45Z")

</div>

I looked at it a little.  
Excuse me, Filebeat is better or Logstash?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 29, 2018, 7:15pm UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/4 "2018-12-29T19:15:38Z")

</div>

Filebeat is designed as a lightweight shipper, and has limited processing capabilities compared to Logstash. It can however be combined with ingest node pipelines, so which is best will depend on your requirements. Have a look at [this blog post](https://www.elastic.co/blog/should-i-use-logstash-or-elasticsearch-ingest-nodes) for a comparison between ingest node pipelines and Logstash for processing.

---

<div class="post-metadata">

### Author: ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)
#### Post date: [December 30, 2018, 6:15am UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/5 "2018-12-30T06:15:22Z")

</div>

Thank you.  
I just want to send Nginx and other web services log to Elasticsearch and Kibana.  
Can I send Log to Elasticsearch and Kibana directly? I mean is that the server that Elasticsearch and Kibana installed on it not have Log agent.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 30, 2018, 8:32am UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/6 "2018-12-30T08:32:10Z")

</div>

Yes, Filebeat can send data directly to Elasticsearch on a separate server. Have a look at [this webinar](https://www.elastic.co/elasticon/conf/2017/sf/small-medium-or-large-evolve-your-elastic-stack-to-fit) for a discussion around ingest architectures.

---

<div class="post-metadata">

### Author: ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)
#### Post date: [December 30, 2018, 8:53am UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/7 "2018-12-30T08:53:24Z")

</div>

Thus, "Filebeat" is better than "Logstash" in my scenario? Logstash can't send files directly?

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [December 30, 2018, 9:05am UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/8 "2018-12-30T09:05:18Z")

</div>

Logstash can naturally also send data directly to Elasticsearch. Have a look at the resources I linked to to select the option that is right for you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 27, 2019, 9:05am UTC](https://discuss.elastic.co/t/program-for-send-log-from-linux/162414/9 "2019-01-27T09:05:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
