Should I use elastic search for logging without logstash

Question

I'm planning on using Elasticsearch to log all my application activities (like an audit log).

Considering how I have direct control over the application, should I directly push the data into Elasticsearch using their REST APIs or should I somehow use Logstash to feed data into Elasticsearch?

Is there any reason I should use Logstash when I can directly push data into Elasticsearch? It's an additional layer to manage.

Answer 1

If you need to parse different log formats (eventlog, syslog and so on), support different transports (UDP, TCP and so on) and log outputs use Logstash. If http is good for you and you collect logs only from one application use ES directly. Logstash is an additional tool. Details are here.