# Switching from Logstash to Beats

**URL:** <https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957>\
**Category:** Beats\
**Created:** [January 23, 2016, 8:44pm UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957 "2016-01-23T20:44:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stuart\_Cracraft](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Stuart\_Cracraft](https://discuss.elastic.co/u/Stuart_Cracraft)\
**Post date:** [January 23, 2016, 8:44pm UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957/1 "2016-01-23T20:44:22Z")

</div>

I currently have Logstash 1.5.5 shipper installed on all my boxes. For the most part, no issues. They all go into a largish Elasticsearch cluster and are fronted by Kibana. No problem collecting a bunch of files with logstash-shipper from the nodes. But, one box continually crashes, about once per day and I figure that's good enough reason to chuck 1.5.5 on all and upgrade to Beats as its written in a better language (Go), shouldn't have the same issues of memory leaks (hopefully) and may crash less often (or never).

My question, assuming all the above is true is: given a logstash-shipper.conf file which has standard syntax for redirecting a lot of logfiles, what is the most painless way to migrate from 1.5.5 to beats instead. Is it backward compatible with the logstash-shipper.conf file? If not, is there a converter? Is the syntax similarly trivial?

Is Beats reliable enough (yet) to entrust things to like precious logs. I don't want crashing logstash forwarders and shippers. Once this is done, I do not want to revisit it.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 24, 2016, 3:41am UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957/2 "2016-01-24T03:41:28Z")

</div>

> [@Stuart\_Cracraft](#):
>
> Is it backward compatible with the logstash-shipper.conf file? If not, is there a converter? Is the syntax similarly trivial?

No. No. Yes. 🙂

> [@Stuart\_Cracraft](#):
>
> Is Beats reliable enough (yet) to entrust things to like precious logs. I don't want crashing logstash forwarders and shippers.

Given LSF is deprecated and replaced with filebeat, yes.

---

<div class="post-metadata">

**Author:** ![Stuart\_Cracraft](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Stuart\_Cracraft](https://discuss.elastic.co/u/Stuart_Cracraft)\
**Post date:** [January 24, 2016, 4:08am UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957/3 "2016-01-24T04:08:54Z")

</div>

Tnx bud.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [January 24, 2016, 4:10am UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957/4 "2016-01-24T04:10:54Z")

</div>

No worries mate.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/switching-from-logstash-to-beats/39957/5 "2017-07-05T21:56:26Z")

</div>