I have a pretty basic elk setup which aggregates logs from around 15 VMs that are running various services.
All of them have configured filebeat syslog forwarder with a single input in logstash.
I have app servers where I run NodeJS web apps, which output JSON logs. In order to make my logs structured I have two options :
Tell the NodeJS apps to output the logs in a
/var/app/app.log rotatable file. Add the
app.log to my log propspect in filebeat and push to logstash, where I setup a filter on
[source] =~ app.log to parse JSON.
Tell the NodeJS app to use a module ( e.g.
node-bunyan-lumberjack ) which connects independently to logstash and pushes the logs there, without using filebeat.
My question is :
Which one is a more common setup and why?