@Reid-Cooper said:
How does filebeat compare for how it is used?
I'm not done building yet so I can't say. Here's what they say the changes are,
Filebeat introduces the following major changes:
The config file was restructured and converted from JSON to YAML.
The registry file, which stores the state of the currently read files, was changed.
Command line options were removed and moved to the configuration file.
Configuration options for outputs are now inherited from libbeat. For details, see the Beats Platform Reference.
A new Logstash input plugin called logstash-input-beats is required.
It doesn't seem like you would notice a difference.