# Which process comes first in Filebeat v.8？

**URL:** <https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 19, 2023, 12:34am UTC](https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822 "2023-05-19T00:34:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![m-amano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m-amano/32/62977_2.png) [@m-amano](https://discuss.elastic.co/u/m-amano)\
**Post date:** [May 19, 2023, 12:34am UTC](https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822/1 "2023-05-19T00:34:41Z")

</div>

Hello. I'm using Filebeat v.8.6.2 to send data to Logstash with filestream input type and I'm curious about which process comes first.

1. Harvest input file data(end of file reached)
2. Connecting Filebeat to Logstash

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [May 19, 2023, 9:13am UTC](https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822/2 "2023-05-19T09:13:30Z")

</div>

According to the FB log, it's read lines, make a bulk batch(default is 2048 events), connect to LS, send data, and again and again. You can see activities in FB logs, especially in the debug mode.

[How Filbeat works](https://www.elastic.co/guide/en/beats/filebeat/current/how-filebeat-works.html)  
[Configure the Logstash output](https://github.com/elastic/beats/edit/8.7/libbeat/outputs/logstash/docs/logstash.asciidoc)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2023, 11:14am UTC](https://discuss.elastic.co/t/which-process-comes-first-in-filebeat-v-8/333822/3 "2023-06-16T11:14:32Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
