Filebeat - parse fields from message line Filebeat - parse fields from message line elasticsearch elasticsearch

Filebeat - parse fields from message line


You can use Filebeat -> Elasticsearch if you make use of the Ingest Node feature in Elasticsearch 5.0. Otherwise, yes, you need to use Logstash.

In both cases you would use a grok filter to parse the message line into structured data. Also you'll want to use a date to parse and normalize the date.