What is the benefit of using Filebeat alone?
What is the advantage of using Logstash alone?
What is the advantage of using Filebeat and Logstash?
Welcome to our community! 
Filebeat is a little more compact than Logstash, and may be more efficient to run.
Logstash can do much more data manipulation and enhancement compared to Filebeat.
We collect a large amount of logs.
What do you advice me?
If you need to collect them across large numbers of hosts, then use Filebeat.
If you need to do processing of the logs beyond what Filebeat and the Ingest API in Elasticsearch can do, then use Logstash.
As I understand it, if I want to collect a large number of hosts, it is better to use Filebeat. But, if these hostes are too wordy, is it better to use logstash?
What do you mean by wordy?
A host that produces a lot of events
Then my response here still applies - Using Filebeat or Logstash
The use of one or the other then depends on the verbosity of the host.
Use filebeat on the clients to get the logs off with as little overhead as possible.
Log parsing can be done with logstash or elastic ingress pipelines. If you are like me and your ELK adventures began before ingress pipelines existed, you have legacy investment in logstash and may find it easier to develop your own pipelines in logstash. If you are using Elastic Co provided pipelines or trusted open source code, use it where it fits 
Do you have a sample configuration?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.