# Why do we need logstash

**URL:** <https://discuss.elastic.co/t/why-do-we-need-logstash/309379>\
**Category:** Logstash\
**Created:** [July 12, 2022, 6:35am UTC](https://discuss.elastic.co/t/why-do-we-need-logstash/309379 "2022-07-12T06:35:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yugeeklab](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yugeeklab/32/108180_2.png) [@yugeeklab](https://discuss.elastic.co/u/yugeeklab)\
**Post date:** [July 12, 2022, 6:35am UTC](https://discuss.elastic.co/t/why-do-we-need-logstash/309379/1 "2022-07-12T06:35:07Z")

</div>

I found out my Logstash has no logic except for forwarding log to Elasticsearch. Filebeat has many logic instead of Logstash(filtering etc.)

In my case, Still do i need Logstash?? Why??

---

<div class="post-metadata">

**Author:** ![Tomo\_M](https://avatars.discourse-cdn.com/v4/letter/t/848f3c/32.png) [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)\
**Post date:** [July 13, 2022, 1:28pm UTC](https://discuss.elastic.co/t/why-do-we-need-logstash/309379/2 "2022-07-13T13:28:59Z")

</div>

In such case, Filebeat may send data to elasticsearch directly. The doc is [here](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html).

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [July 13, 2022, 1:43pm UTC](https://discuss.elastic.co/t/why-do-we-need-logstash/309379/3 "2022-07-13T13:43:12Z")

</div>

If you are not doing any filtering or data enrichment in logstash and it is only sending to Elasticsearch, then maybe you do not need to use Logstash and can configure Filebeat to send directly to Elasticsearch.

It really depends on your use case.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 10, 2022, 1:43pm UTC](https://discuss.elastic.co/t/why-do-we-need-logstash/309379/4 "2022-08-10T13:43:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.