# Quick query about accepting data logstash or filebeat?

**URL:** <https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031>\
**Category:** Elasticsearch\
**Created:** [August 31, 2017, 6:04pm UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031 "2017-08-31T18:04:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [August 31, 2017, 6:04pm UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/1 "2017-08-31T18:04:16Z")

</div>

Hi Guys,

I have quick query and I really would appreaciate if someone can answer it?  
What is the better way to accept messages from server to elastic stack if installed on same server?  
I mean lets say I have apache, nginx, Windows server and couple of Linux mail servers what would you recommend to injest message in es?

through logstash to ES or through filebeat on end computers into logstash on ELK and then to ES?

Since I am not so familiar with logstash and grok patterns; I am finding bit difficult to normalize the logs hence wanted to understand the best practise? Will filebeat suffice my need?

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [September 7, 2017, 4:58am UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/2 "2017-09-07T04:58:16Z")

</div>

Hello, first of all, installing Elasticsearch on the same server as your application (i.e apache, nginx, etc) is not recommended since Elasticsearch is I/O and CPU intensive.

Lastly, if you are not familiar with Logstash then you may find [Filebeat Modules](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html) useful.

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 11, 2017, 3:58am UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/3 "2017-09-11T03:58:36Z")

</div>

Yep thanks for the reply and since this is my test environment I have setup ELK components on same machine.

What is best practise would you recommend in production? Elastic on separate server and LK on separate?

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [September 11, 2017, 4:01am UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/4 "2017-09-11T04:01:38Z")

</div>

> [@Blason](#):
>
> What is best practise would you recommend in production? Elastic on separate server and LK on separate?

This might be of your interest [Scaling Elasticsearch, Kibana, Beats, and Logstash | Elastic Blog](https://www.elastic.co/blog/small-medium-or-large-scaling-elasticsearch-and-evolving-the-elastic-stack-to-fit)

---

<div class="post-metadata">

**Author:** ![Blason](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/blason/32/42284_2.png) [@Blason](https://discuss.elastic.co/u/Blason)\
**Post date:** [September 11, 2017, 4:16am UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/5 "2017-09-11T04:16:15Z")

</div>

awesome buddy!! Thanks a ton for sharing this info.

---

<div class="post-metadata">

**Author:** ![thiago](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thiago/32/32096_2.png) [@thiago](https://discuss.elastic.co/u/thiago)\
**Post date:** [September 11, 2017, 4:17am UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/6 "2017-09-11T04:17:10Z")

</div>

yw 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 9, 2017, 4:17am UTC](https://discuss.elastic.co/t/quick-query-about-accepting-data-logstash-or-filebeat/99031/7 "2017-10-09T04:17:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.