Why to use Logstash if FileBeat can communicate with Elasticsearch directly

Elastic Stack Logstash
1

Hi All,
I have started learning about ELK. The initial tutorial I came across , uses NGINX logs and NGINX Filebeat module for the demo. I see that we can configure Filebeat to send the logs directly to elasticsearch. If Filebeat can do that, I am trying to understand why Logstash would be required.

Can someone please help me or provide me the pointers that can help me understand why Logstash would be required.

Regards,
Ashish

2

If all you want to do is send lines from a log file to elasticsearch as documents then logstash is not required. In the case of web server logs, logstash can enrich the lines using filters such as geoip or useragent. If you do not need that then do not use it.

3

Thanks Badger.
I have seen that filebeat to supports geoip or useragent. I see that in nginx module.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.