Answers: <p>Both are common and comes with their own pro and cons.</p>
  
  <p>It depends if you can accept loosing logs if logstash is dead and your app restart and on the other hand if you can write logs to disk and consume place there.</p>
  
  <p>Those are the basic points to choose for one or the other, you may end up with more caveats in term of IO/caching/etc.</p>
  
  <p>There's no 'best' option, there's the best option for your organization/teams which we can't answer for you as we don't know your environment.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-12-14T14:25:25.143Z
Answers: 2017-12-14T14:25:25.143Z
Answers: Tensibai
Body: <p>I have a pretty basic elk setup which aggregates logs from around 15 VMs that are running various services.</p>
  
  <p>All of them have configured filebeat syslog forwarder with a single input in logstash.</p>
  
  <p>I have app servers where I run NodeJS web apps, which output JSON logs. In order to make my logs structured I have two options :</p>
  
  <h3>Option A</h3>
  
  <p>Tell the NodeJS apps to output the logs in a <code>/var/app/app.log</code> rotatable file. Add the <code>app.log</code> to my log propspect in filebeat and push to logstash, where I setup a filter on <code>[source] =~ app.log</code> to parse JSON.</p>
  
  <h3>Option B</h3>
  
  <p>Tell the NodeJS app to use a module ( e.g. <code>node-bunyan-lumberjack</code> ) which connects independently to logstash and pushes the logs there, without using filebeat.</p>
  
  <p>My question is :</p>
  
  <p><strong>Which one is a more common setup and why?</strong> </p>
  
Tags: <logging><logstash>
Title: Should I use filebeat or an app-logging module with lumberjack capabilities to collect my logs
UserDisplayName: Ivan Drinchev
ThreadText: # Should I use filebeat or an app-logging module with lumberjack capabilities to collect my logs
  
  (Asked by: username_0 on 2017-12-14)
  
  I have a pretty basic elk setup which aggregates logs from around 15 VMs that are running various services.
  
  All of them have configured filebeat syslog forwarder with a single input in logstash.
  
  I have app servers where I run NodeJS web apps, which output JSON logs. In order to make my logs structured I have two options :
  
  ### Option A
  
  Tell the NodeJS apps to output the logs in a `/var/app/app.log` rotatable file. Add the `app.log` to my log propspect in filebeat and push to logstash, where I setup a filter on `[source] =~ app.log` to parse JSON.
  
  ### Option B
  
  Tell the NodeJS app to use a module ( e.g. `node-bunyan-lumberjack` ) which connects independently to logstash and pushes the logs there, without using filebeat.
  
  My question is :
  
  **Which one is a more common setup and why?**
  
  **Tags:** logging, logstash
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-12-14. Score: 5 | Accepted answer
  
  Both are common and comes with their own pro and cons.
  
  It depends if you can accept loosing logs if logstash is dead and your app restart and on the other hand if you can write logs to disk and consume place there.
  
  Those are the basic points to choose for one or the other, you may end up with more caveats in term of IO/caching/etc.
  
  There's no 'best' option, there's the best option for your organization/teams which we can't answer for you as we don't know your environment.
  
  
  ---
  
  