# Logstash pipeline with Auditbeat and Filebeat

**URL:** <https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513>\
**Category:** Open Source Elasticsearch and Kibana\
**Tags:** configure, install\
**Created:** [March 22, 2024, 9:32am UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513 "2024-03-22T09:32:43Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![gray653](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@gray653](https://forum.opensearch.org/u/gray653)\
**Post date:** [March 22, 2024, 9:32am UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/1 "2024-03-22T09:32:43Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

OpenSearch 2.12  
Logstash 8.9.0  
Ubuntu 20.04  
Firefox

**Describe the issue** :

I have installed and managed to use Opensearch and Opensearch Dashboard, as well as able to use Logstash to input logs to Opensearch Dashboard. But now i want to create a pipeline including Auditbeat, Filebeat to push data to Logstash and then to Opensearch. I have searched for a lot of docs but there are still no docs that have clear guide about that. Can someone suggest me docs or briefly explain to me what i should do?

Thanks  
Gray

---

<div class="post-metadata">

**Author:** ![jasonrojas](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jasonrojas/32/4902_2.png) [@jasonrojas](https://forum.opensearch.org/u/jasonrojas)\
**Post date:** [March 22, 2024, 3:36pm UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/2 "2024-03-22T15:36:02Z")

</div>

I think this doc from elastic covers it fairly well -

> **[Configure the Logstash output | Auditbeat Reference \[7.17\] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/7.17/logstash-output.html)**

You’ll just need to change the output to opensearch and make sure logstash has the opensearch output plugin.

If you are running a logstash version that doesnt support the opensearch plugin you would need an intermediary sink (output) like redis or similar and then an input on the logstash side to pull from redis ie: (auditbeat → redis → logstash)

---

<div class="post-metadata">

**Author:** ![gray653](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@gray653](https://forum.opensearch.org/u/gray653)\
**Post date:** [March 25, 2024, 8:34am UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/3 "2024-03-25T08:34:24Z")

</div>

I’ve managed to install auditbeat and now trying to install both filebeat and auditbeat to push files to logstash. Thank you so much for your help!

Gray

---

<div class="post-metadata">

**Author:** ![gray653](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@gray653](https://forum.opensearch.org/u/gray653)\
**Post date:** [March 25, 2024, 9:53am UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/4 "2024-03-25T09:53:39Z")

</div>

Im having another problem, this is the pipelines.yml after i use both Auditbeat and Filebeat as the input of Logstash

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/a/ab55a5c2f1f37eab4b46b1d9d42246ae172776bc.png)

and when i try running the Logstash, it always shows this error:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/2/219bd08ce37019ffeda80ddee423b7a8a038b844.png)  
saying that I lack something at line 121, but i don’t really know since i have checked my pipelines.yml many times.

Maybe the structure of my pipelines.yml is wrong since output must be seperated from filter?

---

<div class="post-metadata">

**Author:** ![jasonrojas](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jasonrojas/32/4902_2.png) [@jasonrojas](https://forum.opensearch.org/u/jasonrojas)\
**Post date:** [March 25, 2024, 4:25pm UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/5 "2024-03-25T16:25:00Z")

</div>

You’re mixing outputs inside of the filter block, logstash configs are

Input{}  
Filter {}  
Output {}

---

<div class="post-metadata">

**Author:** ![gray653](https://avatars.discourse-cdn.com/v4/letter/g/5f9b8f/32.png) [@gray653](https://forum.opensearch.org/u/gray653)\
**Post date:** [March 26, 2024, 1:23am UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/6 "2024-03-26T01:23:19Z")

</div>

Oh right thanks i also thought that my structure seems wrong

Thanks so much for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [May 25, 2024, 1:24am UTC](https://forum.opensearch.org/t/logstash-pipeline-with-auditbeat-and-filebeat/18513/7 "2024-05-25T01:24:10Z")

</div>

Closed on May 25, 2024, 1:24am UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.