Do I have to use Filebeat to parse logs with logstash?

Question

I was under the impression that Filebeat is only necessary if I wish to provide a constant, paced, fresh input to logstash.

But the tutorial here starts with configuring Filebeat to send log lines to logstash....

I am confused. I am a total newbie rookie to ELK and I don't understand why Filebeat is needed if I used the 'file {}' input in the logstash.conf.

Could you please explain this?

Answer 1

No, you don't have to use Filebeat if you choose to use the file option.

You can easily test this using the following conf file:

input {
  file {
  path => "/var/log/debug.log"
  start_position => "beginning"
  sincedb_path => "/dev/null"
  }
}

output {
  stdout {}
}

Upon starting logstash -f /path/to/your/test.conf, you will see on your stdout console the contents of your debug.log input file, formatted into JSON fields.