The simple answer is that when logging files, you will almost always need to use a combination of Filebeat and Logstash. This is because, unless you’re only interested in the timestamp and message fields, Logstash is essential for the "T" in ETL (Transformation) and acts as an aggregator for multiple logging pipelines.

For more detailed insights, you can refer to the source: Filebeat vs. Logstash.