Migrating from Logstash Forwarder to Filebeat

Filebeat is based on the Logstash Forwarder source code and replaces Logstash Forwarder as the method to use for tailing log files and forwarding them to Logstash.

Filebeat introduces the following major changes:

  • The config file was restructured and converted from JSON to YAML.
  • The registry file, which stores the state of the currently read files, was changed.
  • Command line options were removed and moved to the configuration file.
  • Configuration options for outputs are now inherited from libbeat. For details, see the Beats Platform Reference.
  • The Beats input plugin for Logstash is required.

The following topics describe how to migrate from Logstash Forwarder to Filebeat: