# Using Filebeat or Logstash
**URL:** https://discuss.elastic.co/t/using-filebeat-or-logstash/254332
**Category:** Beats
**Tags:** filebeat
**Created:** [November 4, 2020, 8:52pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332 "2020-11-04T20:52:34Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [November 4, 2020, 8:52pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/1 "2020-11-04T20:52:34Z")
What is the benefit of using Filebeat alone?
What is the advantage of using Logstash alone?
What is the advantage of using Filebeat and Logstash?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 4, 2020, 9:58pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/2 "2020-11-04T21:58:50Z")
Welcome to our community! 😃
Filebeat is a little more compact than Logstash, and may be more efficient to run.
Logstash can do much more data manipulation and enhancement compared to Filebeat.
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [November 4, 2020, 10:04pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/3 "2020-11-04T22:04:49Z")
> [@warkolm](#):
>
> Filebeat is a little more compact than Logstash, and may be more efficient to run.
> Logstash can do much more data manipulation and enhancement compared to Filebeat.
We collect a large amount of logs.
What do you advice me?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 4, 2020, 10:07pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/4 "2020-11-04T22:07:51Z")
If you need to collect them across large numbers of hosts, then use Filebeat.
If you need to do processing of the logs beyond what Filebeat and the Ingest API in Elasticsearch can do, then use Logstash.
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [November 4, 2020, 10:33pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/5 "2020-11-04T22:33:39Z")
> [@warkolm](#):
>
> If you need to collect them across large numbers of hosts, then use Filebeat.
> If you need to do processing of the logs beyond what Filebeat and the Ingest API in Elasticsearch can do, then use Logstash.
As I understand it, if I want to collect a large number of hosts, it is better to use Filebeat. But, if these hostes are too wordy, is it better to use logstash?
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 4, 2020, 10:34pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/6 "2020-11-04T22:34:12Z")
What do you mean by wordy?
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [November 4, 2020, 10:36pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/7 "2020-11-04T22:36:32Z")
> [@warkolm](#):
>
> What do you mean by wordy?
A host that produces a lot of events
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [November 4, 2020, 10:37pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/8 "2020-11-04T22:37:33Z")
Then my response here still applies - [Using Filebeat or Logstash](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/4)
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [November 4, 2020, 10:41pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/9 "2020-11-04T22:41:59Z")
The use of one or the other then depends on the verbosity of the host.
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [November 5, 2020, 2:10am UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/10 "2020-11-05T02:10:11Z")
Use filebeat on the clients to get the logs off with as little overhead as possible.
Log parsing can be done with logstash or elastic ingress pipelines. If you are like me and your ELK adventures began before ingress pipelines existed, you have legacy investment in logstash and may find it easier to develop your own pipelines in logstash. If you are using Elastic Co provided pipelines or trusted open source code, use it where it fits 🙂
---
### Author:  [@Falikou1](https://discuss.elastic.co/u/Falikou1)
#### Post date: [November 5, 2020, 4:34pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/11 "2020-11-05T16:34:20Z")
> [@rugenl](#):
>
> Use filebeat on the clients to get the logs off with as little overhead as possible.
>
> Log parsing can be done with logstash or elastic ingress pipelines. If you are like me and your ELK adventures began before ingress pipelines existed, you have legacy investment in logstash and may find it easier to develop your own pipelines in logstash. If you are using Elastic Co provided pipelines or trusted open source code, use it where it fits
Do you have a sample configuration?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 3, 2020, 6:34pm UTC](https://discuss.elastic.co/t/using-filebeat-or-logstash/254332/12 "2020-12-03T18:34:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.