How does filebeats get invoked when using logstash in this java spring boot app?

Question

I am sending logs from my applciation logstash successfully, i started with this tutorial http://www.andrew-programming.com/2018/09/18/integrate-springboot-application-with-elk-and-filebeat/ then implemented my code in to my own apps easily.

The question I have is that I haven't mentioned filebeats anywhere in my app, how is it being used?

Everything is working but curious to know where filebeats comes is, is it through the logstash dependency in the pom file?

logback-spring.xml

<!DOCTYPE configuration>
<configuration>
  <appender name="LOGSTASH" class="net.logstash.logback.appender.LogstashTcpSocketAppender">
    <destination>localhost:4560</destination>
    <encoder charset="UTF-8" class="net.logstash.logback.encoder.LogstashEncoder">
    </encoder>
  </appender>

  <include resource="org/springframework/boot/logging/logback/base.xml"/>

  <root level="INFO">
    <appender-ref ref="LOGSTASH" />
    <!--<appender-ref ref="CONSOLE" />-->
  </root>

</configuration>

application.properties

logging.file=/tmp/filebeatDemoApp.log

pom dependency

        <dependency>
            <groupId>net.logstash.logback</groupId>
            <artifactId>logstash-logback-encoder</artifactId>
            <version>5.1</version>
        </dependency>

logstash.conf

input {
  tcp {
  port => 4560
  codec => json_lines
  }
  beats {
    host => "127.0.0.1"
    port => "5044"
  }
}
output{
  stdout { codec => rubydebug }
  elasticsearch {
  hosts => ["localhost:9200"]
  index => "app-%{+YYYY.MM.dd}"   
  document_type => "%{[@metadata][type]}"
  }
}

Answer 1

You are not using Filebeat. With <destination>localhost:4560</destination> you are sending directly to Logstash. It's nice because you don't need to care about logfiles, parsing them, or filling up the disk. Downside is that you won't receive any messages if the network is down and Logback will only buffer 200MB of logs from what I remember — so you might lose logs during extended outages.

PS: When using this configuration you can remove the beats { block from the logstash.conf since you aren't using it (and Filebeat too).