# Why do i need Logstash if filebeat can send data to Elasticsearch

**URL:** <https://discuss.elastic.co/t/why-do-i-need-logstash-if-filebeat-can-send-data-to-elasticsearch/70965>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 9, 2017, 4:10pm UTC](https://discuss.elastic.co/t/why-do-i-need-logstash-if-filebeat-can-send-data-to-elasticsearch/70965 "2017-01-09T16:10:35Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![sezanawa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sezanawa/32/21910_2.png) [@sezanawa](https://discuss.elastic.co/u/sezanawa)\
**Post date:** [January 10, 2017, 8:40am UTC](https://discuss.elastic.co/t/why-do-i-need-logstash-if-filebeat-can-send-data-to-elasticsearch/70965/4 "2017-01-10T08:40:05Z")

</div>

Hi @magnusbaeck

Thanks for precise information. Actually i was looking for to add Filter property in Filebeat so that my nodes send data directly to ES in a format which i am expecting for kibana. But it seems like filebeat does not offer grok filtering method, according to following thread.

> <https://github.com/elastic/beats/issues/679>
>
> Sounds like a pretty obvious win for efficiency, especially seeing as those crea…ting the logs are more likely to know what format they are in.
> 
> There are a couple of golang bindings for grok already in existence:
> https://github.com/jbuchbinder/gogrok
> https://github.com/blakesmith/go-grok
> https://github.com/scalingdata/go-grok
> 
> Happy to take a crack at it myself

but don't you think its enough to use filtering at prospector level can done the job for me. Here is my previous thread (where u already have answered a lot 🙂 ) which show how my logs look like and what grok filter i have applied to parse it.

> [@How to configure ELK (Elasticsearch, Logstash,Kibana) for different application log files and display each application separately in Kibana?](https://discuss.elastic.co/t/how-to-configure-elk-elasticsearch-logstash-kibana-for-different-application-log-files-and-display-each-application-separately-in-kibana/70411/12):
>
> is this my else condition which cause logstash-\* index ? It sounds like you effectively have this: output { if [type] == "OnsuranceAppLog" { elasticsearch { hosts =\> ["localhost:9200"] index =\> "onsurance-%{+YYYY.MM.dd}" } } else { elasticsearch { hosts =\> ["localhost:9200"] } stdout { codec =\> rubydebug } } if [type] == "iis" { elasticsearch { hosts =\> ["localhost:9200"] index =\> "iis-%{+YYYY.MM.dd}" } } else { elas…

Whats your Suggestion? do i still need a Logstash ? i have not yet tested Filebeat and prospector level filtering, that's why asking community about there experiences ?

Thanks in advance  
best regards

---

_[View the full topic](https://discuss.elastic.co/t/why-do-i-need-logstash-if-filebeat-can-send-data-to-elasticsearch/70965)._