# Question regarding "where" log data is process
**URL:** https://discuss.elastic.co/t/question-regarding-where-log-data-is-process/222380
**Category:** Beats
**Tags:** filebeat
**Created:** [March 5, 2020, 10:25pm UTC](https://discuss.elastic.co/t/question-regarding-where-log-data-is-process/222380 "2020-03-05T22:25:53Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@john\_eapen](https://discuss.elastic.co/u/john_eapen)
#### Post date: [March 5, 2020, 10:25pm UTC](https://discuss.elastic.co/t/question-regarding-where-log-data-is-process/222380/1 "2020-03-05T22:25:54Z")
Hi Team,
[Deployment: Filebeat as kube daemonset running on dozens of nodes directly sending data to ES(AWS ES)]. ( ie no intermediate logstash involved ). I have Not configured or specified any pipelines in my filebeat config either.
In terms of processing load, where is the data processing taking place.
- Is the initial parsing happening at the filebeat node ?
- Are any processors executed at ES ? ( eg: rename/drop field etc )
- Specially where does "Groking" take place as specified in the filebeat modules ?
As I understand some processors like geo-ip/user-agent for nginx are executed on ES
as ingest pipelines.
Thanks
JE
---
### Author:  [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [March 6, 2020, 11:38am UTC](https://discuss.elastic.co/t/question-regarding-where-log-data-is-process/222380/2 "2020-03-06T11:38:57Z")
Hey @john_eapen,
There are two main places where processing is done when using filebeat:
- [Processors](https://www.elastic.co/guide/en/beats/filebeat/7.6/defining-processors.html) defined in the configuration file are executed in filebeat.
- [Ingest pipelines](https://www.elastic.co/guide/en/beats/filebeat/7.6/configuring-ingest-node.html) are executed in Elasticsearch.
The same event can be processed by both pipelines, by the one defined with Filebeat processors, and the one defined in an ingest pipeline in Elasticsearch.
Some processing features are available in both places, so you can chose where it is better to do the processing. Other features are only available in one of the places. For example processors that need information about the node where Filebeat is running are only available in Filebeat processors. As you mention, other processors that need access to centralized databases as geoip or useragent, are only available in Elasticsearch.
Grok processor is only available in Elasticsearch, but the somehow similar dissect processor is available both [in Filebeat](https://www.elastic.co/guide/en/beats/filebeat/7.6/dissect.html) and [in Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/7.6/dissect-processor.html).
[Filebeat modules](https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-modules-overview.html) use to combine both processing mechanisms, so they use to include both processors and ingest pipelines to handle the logs of specific services.
---
### Author:  [@john\_eapen](https://discuss.elastic.co/u/john_eapen)
#### Post date: [March 6, 2020, 7:13pm UTC](https://discuss.elastic.co/t/question-regarding-where-log-data-is-process/222380/3 "2020-03-06T19:13:32Z")
Hi @jsoriano
Thank you for the reply. This really helps.
-JE
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 3, 2020, 7:13pm UTC](https://discuss.elastic.co/t/question-regarding-where-log-data-is-process/222380/4 "2020-04-03T19:13:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.