For packetbeat and topbeat, it is certainly fine to forward events directly to ES as they have boilerplate format and template. However, with filebeat, I would recommend using logstash to "massage the data".
1 Like