# What are the advantages of filebeat 1.2.2 over logstash 2.1.1? **URL:** \ **Category:** Beats\ **Created:** [May 9, 2016, 10:33pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593 "2016-05-09T22:33:34Z")\ **Posts on this page:** 18\ **Page:** 1
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 9, 2016, 10:33pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/1 "2016-05-09T22:33:34Z")
I get a fair number of crashes of the latter which I have always assumed is because of bugs and the java runtime and that one of the advantages I might enjoy with filebeat is that it is written in Go and perhaps has better memory management, fewer leaks, and better architecture. So I am searching for reasons as to how best to justify filebeat over logstash for a large installation. Thoughts? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 10, 2016, 7:23am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/2 "2016-05-10T07:23:47Z")
Beats do not do geoip, they don't do translations, grok and much much more. They are great for shippers, but analysis still belongs to LS. (Also latest is 2.3.2 🙂 ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 10, 2016, 1:06pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/3 "2016-05-10T13:06:30Z")
Do beats crash as mush as logstash? ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 10, 2016, 4:48pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/4 "2016-05-10T16:48:18Z")
I'll refine that question: DOES FILEBEAT CRASH AS MUCH AS LOGSTASH? The issue is that LOGSTASH 2.x crashes heavily here with a very plain, vanilla setup and I have CM restarting it regularly and want to get out from under the scenario above. FILEBEAT, if more stable, would be such a solution. Does anyone out there have filebeat running on a large number of servers and will they comment about the relative rate of their crashes of the filebeat client? Assume the clients are connecting to a logstash server rather than directly to elasticsearch. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [May 10, 2016, 7:33pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/5 "2016-05-10T19:33:25Z")
why does logstash crash? Any errors? What's your use-case. Any filters in logstash? Filebeat is no logstash replacement, but an addition to the stack. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 10, 2016, 8:54pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/6 "2016-05-10T20:54:01Z")
LS SHOULD NOT CRASH (heh). If it is then that is a fixable problem. ---
**Author:** ![Stuart\_Cracraft](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Stuart\_Cracraft](https://discuss.elastic.co/u/Stuart_Cracraft)\ **Post date:** [May 11, 2016, 2:05am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/7 "2016-05-11T02:05:27Z")
Well, that's fresh out of the box, without any special rules or transformations, just collecting a bunch of logs and sending them off to an Elasticsearch cluster. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 11, 2016, 4:03am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/8 "2016-05-11T04:03:03Z")
If you can provide more info then perhaps we can help 🙂 ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 11, 2016, 4:13am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/9 "2016-05-11T04:13:48Z")
Yes, I will be glad to do so on the next occurrence. ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 11, 2016, 5:32pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/10 "2016-05-11T17:32:26Z")
Okay, I have a crashed logstash-shipper.log. It is over a megabyte. Where do you want it placed? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 11, 2016, 9:31pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/11 "2016-05-11T21:31:35Z")
> [@Stuart\_Cracraft1](#): > > logstash-shipper.log Is this the LS forwarder or LS itself? Try putting it on gist/pastebin/etc. ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 11, 2016, 9:41pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/12 "2016-05-11T21:41:41Z")
I could only put ~150kb there. Here is the pastebin: [http://pastebin.ca/3597434](http://pastebin.ca/3597434) ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [May 11, 2016, 10:28pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/13 "2016-05-11T22:28:04Z")
Is redis running and reachable? First traces are basically saying: can not connect to redis ```auto CannotConnectError: Error connecting to Redis on 10.10.5.116:6379 (Errno::EHOSTUNREACH) ``` The since\_db info messages are info message to notify you about progress I'd say. I see a very verbose log, but no crash. ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 11, 2016, 10:34pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/14 "2016-05-11T22:34:22Z")
scracraft@devops1:~$ cat [redis-tester.py](http://redis-tester.py) #!/usr/bin/python import redis rs = redis.Redis("10.10.5.116") try: response = rs.client\_list() print "redis server is up" except redis.ConnectionError: print "woops, redis server is down" scracraft@devops1:~$ ./redis-tester.py redis server is up scracraft@devops1:~$ ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 11, 2016, 11:06pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/15 "2016-05-11T23:06:42Z")
irb(main):007:0\> r = Redis.new(:host =\> '10.10.5.116') =\> #\ irb(main):008:0\> r.ping =\> "PONG" irb(main):009:0\> r.ping =\> "PONG" irb(main):010:0\> ---
**Author:** ![Stuart\_Cracraft1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stuart_cracraft1/32/8036_2.png) [@Stuart\_Cracraft1](https://discuss.elastic.co/u/Stuart_Cracraft1)\ **Post date:** [May 11, 2016, 11:36pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/16 "2016-05-11T23:36:37Z")
The only thing I can think of is that the single Redis server isn't capable of dealing with the traffic from the network and should be clustered up. ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [May 12, 2016, 11:54am UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/17 "2016-05-12T11:54:39Z")
maybe this explains why the redis error messages stopped and we got the sincedb entries (sincedb is keeping track of file state). Is redis running stable? Regarding logstash maybe you're better of asking on logstash forum. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/what-are-the-advantages-of-filebeat-1-2-2-over-logstash-2-1-1/49593/18 "2017-07-05T21:52:06Z")