I have been going through a few tutorials on using beats to send data to elasticsearch.
I noticed that some tutorials prefer to use logstash
as the output which then outputs to elasticsearch. Some other tutorials output directly to elasticsearch
.
In the config /etc/packetbeat/packetbeat.yml
that is:
output.logstash:
# The Logstash hosts
hosts: ["localhost:5044"]
Instead of:
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]