Docs
  • Release notes
  • Troubleshoot
  • Reference
  • Get started
  • Solutions and use cases
  • Explore and analyze
  • Deploy and manage
  • Manage your Cloud account and preferences
  • Troubleshoot
  • Extend and contribute
  • Release notes
  • Reference
  • The Elasticsearch data store
    • Index basics
    • Near real-time search
    • Data streams
      • Set up a data stream
      • Use a data stream
      • Modify a data stream
      • Manage a data stream
      • Time series data stream (TSDS)
        • Set up a TSDS
        • Downsampling a time series data stream
        • Run downsampling with ILM
        • Run downsampling manually
        • Run downsampling using data stream lifecycle
        • Reindex a TSDS
      • Logs data stream
    • Mapping
      • Dynamic mapping
        • Dynamic field mapping
        • Dynamic templates
      • Explicit mapping
      • Runtime fields
        • Map a runtime field
        • Define runtime fields in a search request
        • Override field values at query time
        • Retrieve a runtime field
        • Index a runtime field
        • Explore your data with runtime fields
      • Removal of mapping types
    • Text analysis
      • Concepts
        • Anatomy of an analyzer
        • Index and search analysis
        • Stemming
        • Token graphs
      • Configure text analysis
        • Test an analyzer
        • Configuring built-in analyzers
        • Create a custom analyzer
        • Specify an analyzer
    • Templates
      • Simulate multi-component templates
      • Ignore missing component templates
      • Manage index templates
    • Aliases
    • Manage data from the command line
  • Ingestion
    • Ingesting time series data
    • Ingesting data for Elastic solutions
    • Ingesting data from applications
      • Ingest data with Node.js
      • Ingest data with Python
      • Ingest data from Beats with Logstash as a proxy
      • Ingest data from a relational database
      • Ingest logs from a Python application using Filebeat
      • Ingest logs from a Node.js web application using Filebeat
    • Ingest architectures
      • Elastic Agent to Elasticsearch
        • Elastic Agent to Elasticsearch: Agent installed
        • Elastic Agent to Elasticsearch: APIs for collection
      • Elastic Agent to Logstash to Elasticsearch
        • Elastic Agent to Logstash (for enrichment) to Elasticsearch
        • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
        • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
        • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
      • Elastic Agent to proxy to Elasticsearch
      • Elastic Agent to Elasticsearch with Kafka as middleware message queue
        • Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue
        • Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue
      • Logstash to Elasticsearch
      • Elastic air-gapped architectures
        • Elastic Agent to Elasticsearch: Air-gapped environment
        • Elastic Agent to Logstash: Air-gapped environment
    • Sample data
    • Upload data files
    • Transform and enrich data
      • Elasticsearch ingest pipelines
        • Example
      • Logstash pipelines
      • Data enrichment
        • Set up an enrich processor
        • Example: Enrich your data based on geolocation
        • Example: Enrich your data based on exact values
        • Example: Enrich your data by matching a value to a range
      • Index mapping and text analysis
    • Ingest tools overview
  • Data lifecycle
    • Data tiers
    • Index lifecycle management
      • Index lifecycle
      • Rollover
        • Skip rollover
        • Tutorial: Automate rollover
      • Configure a policy
      • Update a policy
      • Start and stop ILM
      • Restore a managed data stream or index
      • Tutorial: Customize built-in policies
      • Index management in Kibana
      • Manage existing indices
      • Migrate to index lifecycle management
      • Migrate index allocation filters to node roles
    • Data stream lifecycle
      • Tutorial: Create a data stream with a lifecycle
      • Tutorial: Update existing data stream
      • Tutorial: Data stream retention
      • Tutorial: Migrate ILM managed data stream to data stream lifecycle
    • Curator
    • Rollup
      • Get started using the API
      • Get started in Kibana
      • Understanding groups
      • Rollup aggregation limitations
      • Rollup search limitations
      • Migrating to downsampling
  • Migrate your Elasticsearch data
    • Reindex from a self-managed cluster
    • Migrate internal indices
  • Use case: use Elasticsearch to manage time series data
Loading
  1. Docs
  2. / Manage data
  3. / Ingestion
  4. / Ingest architectures
  5. /

Elastic Agent to Logstash to Elasticsearch

Image showing {{agent}} to {{ls}} to {{es}}
× Image showing {{agent}} to {{ls}} to {{es}}
Ingest models
Elastic Agent to Elasticsearch using Logstash for advanced use cases such as enrichment, buffering, network bridging, multiple endpoints

Elastic Agent to Logstash to Elasticsearch architectures

  • Elastic Agent to Logstash (for enrichment) to Elasticsearch
  • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
  • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
  • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
Previous
Elastic Agent to Elasticsearch: APIs for collection
Next
Elastic Agent to Logstash (for enrichment) to Elasticsearch
  • Current version ✓
  • Previous version (8.18)
  • Edit this page
  • Report an issue
On this page
  • Elastic Agent to Logstash to Elasticsearch architectures
Elastic logo
  • Trademarks
  • Terms of Use
  • Privacy
  • Sitemap

© 2025 Elasticsearch B.V. All Rights Reserved.

Elasticsearch is a trademark of Elasticsearch B.V., registered in the U.S. and in other countries. Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Welcome to the docs for the latest Elastic product versions, including Elastic Stack 9.0 and Elastic Cloud Serverless. To view previous versions, go to elastic.co/guide.