Filebeat plays a really very important role in this structure. Filebeat is a lightweight shipper which is installed as an agent for forwarding and centralizing log data. Filebeat is used to monitor log files or location, collecting log events and forwards log events to Elasticsearch/Logstash. Filebeat is an agent which needs to be installed on server.
In filebeat we define the logstash ip along with the port no. so that when it will fetch our application logs it should transfer them to logstash.
To install the filebeat execute the following command:-
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.1.2-amd64.deb sudo dpkg -i filebeat-5.1.2-amd64.deb
Now define your log path in filebeat configuration file, to edit config file execute:-
sudo vim /etc/filebeat/filebeat.yml
Now mention your log path as mentioned below
Save your configuration and restart filebeat using
sudo service filebeat restart