# Why to use Logstash if FileBeat can communicate with Elasticsearch directly

**URL:** https://discuss.elastic.co/t/why-to-use-logstash-if-filebeat-can-communicate-with-elasticsearch-directly/230290
**Category:** Logstash
**Created:** [April 29, 2020, 3:00am UTC](https://discuss.elastic.co/t/why-to-use-logstash-if-filebeat-can-communicate-with-elasticsearch-directly/230290 "2020-04-29T03:00:37Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Ashish\_Chaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashish_chaudhari/32/47533_2.png) [@Ashish\_Chaudhari](https://discuss.elastic.co/u/Ashish_Chaudhari)
#### Post date: [April 29, 2020, 3:00am UTC](https://discuss.elastic.co/t/why-to-use-logstash-if-filebeat-can-communicate-with-elasticsearch-directly/230290/1 "2020-04-29T03:00:37Z")

</div>

Hi All,  
I have started learning about ELK. The initial tutorial I came across , uses NGINX logs and NGINX Filebeat module for the demo. I see that we can configure Filebeat to send the logs directly to elasticsearch. If Filebeat can do that, I am trying to understand why Logstash would be required.

Can someone please help me or provide me the pointers that can help me understand why Logstash would be required.

Regards,  
Ashish

---

<div class="post-metadata">

### Author: ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [April 29, 2020, 1:37pm UTC](https://discuss.elastic.co/t/why-to-use-logstash-if-filebeat-can-communicate-with-elasticsearch-directly/230290/2 "2020-04-29T13:37:37Z")

</div>

If all you want to do is send lines from a log file to elasticsearch as documents then logstash is not required. In the case of web server logs, logstash can enrich the lines using filters such as geoip or useragent. If you do not need that then do not use it.

---

<div class="post-metadata">

### Author: ![Ashish\_Chaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ashish_chaudhari/32/47533_2.png) [@Ashish\_Chaudhari](https://discuss.elastic.co/u/Ashish_Chaudhari)
#### Post date: [May 5, 2020, 3:13am UTC](https://discuss.elastic.co/t/why-to-use-logstash-if-filebeat-can-communicate-with-elasticsearch-directly/230290/3 "2020-05-05T03:13:02Z")

</div>

Thanks Badger.  
I have seen that filebeat to supports geoip or useragent. I see that in nginx module.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 2, 2020, 3:13am UTC](https://discuss.elastic.co/t/why-to-use-logstash-if-filebeat-can-communicate-with-elasticsearch-directly/230290/4 "2020-06-02T03:13:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.