Migrating to the Logstash Input Beats Pluginedit

Filebeat requires a new input plugin in Logstash, called logstash-input-beats. For information about getting started with this plugin, see Setting up Logstash.

In both the 1.5.x and 2.x versions of Logstash, this plugin can be loaded in parallel with the logstash-input-lumberjack plugin used by the Logstash Forwarder.

If you have a large number of servers that you want to migrate from Logstash Forwarder to Filebeat, we recommend that you keep the Lumberjack plugin and load the Beats plugin on the same Logstash instances, but set up the Beats plugin to use a different port. After you have migrated all the machines to Filebeat, you can remove the Lumberjack plugin.