WARNING: Version 5.6 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Filebeat is based on the Logstash Forwarder source code and replaces Logstash Forwarder as the method to use for tailing log files and forwarding them to Logstash.
Filebeat introduces the following major changes:
- The config file was restructured and converted from JSON to YAML.
- The registry file, which stores the state of the currently read files, was changed.
- Command line options were removed and moved to the configuration file.
- Configuration options for outputs are now inherited from libbeat. For details, see the Beats Platform Reference.
- The Beats input plugin for Logstash is required.
The following topics describe how to migrate from Logstash Forwarder to Filebeat: