# Use (FreeBSD) native log shipping instead of Filebeat? **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 29, 2016, 7:51am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975 "2016-02-29T07:51:36Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![gregoryo](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@gregoryo](https://discuss.elastic.co/u/gregoryo)\ **Post date:** [February 29, 2016, 7:51am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975/1 "2016-02-29T07:51:36Z")
I am looking at deploying ELK for some FreeBSD machines, and have reached the section of documentation suggesting I use Filebeat to get logs from source machines into Logstash. I immediately wondered whether I could use the built in centralised logging features of FreeBSD. I don't mind the idea of [grabbing](https://github.com/elastic/beats/issues/583) Filebeat (and fingers crossed the [upcoming port](https://github.com/elastic/beats/issues/1034) will be much nicer than a [nightlies download](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=jenkins/filebeat/)), but if I can use built in features without it becoming an ELK-nightmare, that feels cleaner. Does anyone have any insight into this? TIA, Greg. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [February 29, 2016, 8:22am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975/2 "2016-02-29T08:22:02Z")
Perhaps you can elaborate a little bit more on "ELK-nightmare" to better understand your concerns? ---
**Author:** ![gregoryo](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@gregoryo](https://discuss.elastic.co/u/gregoryo)\ **Post date:** [February 29, 2016, 8:45am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975/3 "2016-02-29T08:45:26Z")
Thanks @ruflin, valid point. I guess I don't want to be beating a new path into strained interoperability between the components. I'm very new to ELK so want to do things as 'standard' as I can. On the other hand I also see value in using core tools from the operating system, or at least packages from its package management system. sysmonk on IRC was helpful in doing some sanity checking for me, so I am feeling a bit more confident to experiment now, but still interested to hear about suggestions, gotchas or other advice. Cheers, Greg. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 1, 2016, 10:11am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975/4 "2016-03-01T10:11:30Z")
It heavily depends on your setup. If you just run one server and you need Logstash, there is no need for filebeat and you can directly use Logstash. If you have several servers and a central Logstash instance, the small and lightweight filebeat instance on each server makes sense. There is also a wide variety of plugins in Logstash to connect some standard systems like syslog: [https://www.elastic.co/guide/en/logstash/current/input-plugins.html](https://www.elastic.co/guide/en/logstash/current/input-plugins.html) There is no "one solution fits all". Best is to let us know what your limitations are and your setup to give some better insights. But experimenting is probably in the end the best way to figure out what fits your environment best. ---
**Author:** ![gregoryo](https://avatars.discourse-cdn.com/v4/letter/g/34f0e0/32.png) [@gregoryo](https://discuss.elastic.co/u/gregoryo)\ **Post date:** [March 31, 2016, 7:53am UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975/5 "2016-03-31T07:53:34Z")
The past month has been enlightening. Filebeat is proving worthwhile, and although I might diverge at some point to something more native to FreeBSD, I'll stick with what works and is from the same source as the other parts of the new setup. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/use-freebsd-native-log-shipping-instead-of-filebeat/42975/6 "2017-07-05T21:54:02Z")