I was under the impression that Filebeat is only necessary if I wish to provide a constant, paced, fresh input to logstash.

But the tutorial here starts with configuring Filebeat to send log lines to logstash....

I am confused. I am a total newbie rookie to ELK and I don't understand why Filebeat is needed if I used the 'file {}' input in the logstash.conf.

Could you please explain this?


No, you don't have to use Filebeat if you choose to use the file option.

You can easily test this using the following conf file:

input {
  file {
  path => "/var/log/debug.log"
  start_position => "beginning"
  sincedb_path => "/dev/null"

output {
  stdout {}

Upon starting logstash -f /path/to/your/test.conf, you will see on your stdout console the contents of your debug.log input file, formatted into JSON fields.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.