# Some answers needed on the technical what/how of Filebeat **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 4, 2016, 7:13am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616 "2016-07-04T07:13:19Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![JohnnyS](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Post date:** [July 4, 2016, 7:13am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/1 "2016-07-04T07:13:19Z")
Hi As I'm still new on filebeat, can I ask somebody: Technical what/how ? • (1) Capture text in log file “error” • (2) Capture reg.exp in log file “[A-Z]+-[0-9]\*/ERR” • Logical operators : capture ( “pattern-1” || “pattern-2” ) && “pattern-3” && ! “pattern-4” • Can filebeat “process” a matched log line  “return” parts of matched log line ORA-[0-9]+ 05/03/2016 22:54:12,12 X main()::fucntions | error, Found something wrong Oracle code ORA-01203 and recreate a new “message” / “keyvalue-pairs” • Enrichment of trapped data with ex. logfile name, host, process, …..  feeding from filebeat configuration (?) • Bucket concept / counting occurrences ? React when condition (1) arrived 10 times in 10 minutes • 1 filebeat per file or 1 filebeat manages mutliple files ? • Log file “file.log” - adding data  trapping - remove file and recreate - adding data  trapping (does this continue correct) • - adding data - “empty” the file without removing - adding data  does trapping continue as expected Performance ? Kind regards Johnny ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 4, 2016, 7:38am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/2 "2016-07-04T07:38:31Z")
Filebeat doesn't parse log files. With the exception of being able to merge multiline events it ships logs as-is. Look into Logstash for such operations. ---
**Author:** ![JohnnyS](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Post date:** [July 4, 2016, 8:02am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/3 "2016-07-04T08:02:02Z")
So, better to use Logstash for all the mentioned questions above, correct? ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [July 4, 2016, 8:37am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/4 "2016-07-04T08:37:59Z")
Or a combination of both. Have filebeat on all the edge servers to fetch the log lines and do the processing on a centralised logstash instance. ---
**Author:** ![JohnnyS](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Post date:** [July 4, 2016, 9:25am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/5 "2016-07-04T09:25:45Z")
Now I'm forwarding my data to elasticSearch directly, can I choose to forward my data to both elasticSearch & Logstash at the same time? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 4, 2016, 9:44am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/6 "2016-07-04T09:44:40Z")
Yes, but why would you want to do that? ---
**Author:** ![JohnnyS](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Post date:** [July 4, 2016, 10:53am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/7 "2016-07-04T10:53:55Z")
Because some date I need to use XML filter to get the right data (Logstash) and other data can be send directly to ElasticSearch I do not have the possibility to use Filebeat.yml config file to filter out the needed data from the XML it seems.. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [July 4, 2016, 11:24am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/8 "2016-07-04T11:24:08Z")
Some lines of input can be excluded from processing by Filebeat, see [https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#exclude-lines](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#exclude-lines). But it sounds like what you're _really_ asking for is "send to ES _or_ Logstash", not "send to ES _and_ Logstash", and that's not supported. ---
**Author:** ![JohnnyS](https://avatars.discourse-cdn.com/v4/letter/j/6de8d8/32.png) [@JohnnyS](https://discuss.elastic.co/u/JohnnyS)\ **Post date:** [July 4, 2016, 11:38am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/9 "2016-07-04T11:38:12Z")
OK, thanks for the information. I will have a look on what's going to be best for me, but I guess forwarding the data to Logstash will provide me more possibilities then doing it via the filebeat.yml config file. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 25, 2016, 7:13am UTC](https://discuss.elastic.co/t/some-answers-needed-on-the-technical-what-how-of-filebeat/54616/10 "2016-07-25T07:13:29Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.