Working with Filebeat Modules

Filebeat comes packaged with pre-built modules that contain the configurations needed to collect, parse, enrich, and visualize data from various log file formats. Each Filebeat module consists of one or more filesets that contain ingest node pipelines, Elasticsearch templates, Filebeat input configurations, and Kibana dashboards.

You can use Filebeat modules with Logstash, but you need to do some extra setup. The simplest approach is to set up and use the ingest pipelines provided by Filebeat. If the ingest pipelines don’t meet your requirements, you can create Logstash configurations to use instead of the ingest pipelines.

Either approach allows you to use the configurations, index templates, and dashboards available with Filebeat modules, as long as you maintain the field structure expected by the index and dashboards.