FileBeat directly to ELS or via LogStash?
<p>We are installing ELS and Kibana for log aggregation/analysis.  The first system to use it is greenfield so we output structured logs from the services that make up our system.  Given that we don't need to add structure to our logs I was planning on using FileBeat to ship the logs directly to ELS and not use LogStash.  Is this a sensible option or does LogStash have value over and above parsing that we might need? If we do use LogStash can I use that to harvest log files or should I still use FileBeat to pump the logs to LogStash?</p>