How to configure Filebeat output to Logstash

Routing Filebeat events to Logstash enables centralized parsing, enrichment, and routing before logs are indexed or archived. The extra hop pays for itself when pipelines need consistent filters, normalized fields, and routing logic that does not belong on every host.

Filebeat ships events using the Beats protocol to a Logstash beats input over TCP, typically on port 5044. The destination is selected in /etc/filebeat/filebeat.yml under the output.* section, and the hosts list can point to one or more Logstash endpoints for resiliency.

Only one output can be enabled in Filebeat at a time, so the Elasticsearch output must be disabled when Logstash is the sole destination. Index templates and dashboards are not installed through the Logstash output, so running filebeat setup still requires direct access to Elasticsearch and Kibana when those assets are needed.

1. Open the Filebeat configuration file.

   $ sudo nano /etc/filebeat/filebeat.yml

2. Switch the output to Logstash.

   #output.elasticsearch:
   #  hosts: ["http://localhost:9200"]
   
   output.logstash:
     hosts: ["localhost:5044"]

   Ensure only one output.* block is enabled in /etc/filebeat/filebeat.yml.

3. Test the configuration syntax.

   $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
   Config OK

   Related: How to test a Filebeat configuration

4. Test the Logstash output connection from the current configuration.

   $ sudo filebeat test output -c /etc/filebeat/filebeat.yml
   logstash: localhost:5044...
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 127.0.0.1, ::1
       dial up... OK
     TLS... WARN secure connection disabled
     talk to server... OK

   TCP connectivity to 5044 must be allowed and the Logstash beats input must be listening.

5. Restart the Filebeat service to apply the output change.

   $ sudo systemctl restart filebeat

   Related: How to manage the Filebeat service with systemctl in Linux

6. Check recent Filebeat logs for successful publishing.

   $ sudo journalctl --unit=filebeat --no-pager --lines=30
   Jan 06 21:04:02 d21b43fc26fd filebeat[5099]: {"log.level":"info","@timestamp":"2026-01-06T21:04:02.932Z","log.logger":"publisher_pipeline_output","message":"Connecting to backoff(async(tcp://localhost:5044))","service.name":"filebeat","ecs.version":"1.6.0"}
   Jan 06 21:04:02 d21b43fc26fd filebeat[5099]: {"log.level":"info","@timestamp":"2026-01-06T21:04:02.933Z","log.logger":"publisher_pipeline_output","message":"Connection to backoff(async(tcp://localhost:5044)) established","service.name":"filebeat","ecs.version":"1.6.0"}
   ##### snipped #####