Choose between rsyslog and Logstash for log aggregation

Use rsyslog when the main task is collecting, routing, or forwarding system and device logs. Use Logstash when the pipeline benefits from its event-processing plugins and Elasticsearch integration. Both can parse and transform data; the choice depends on the transformations and delivery guarantees you need to operate.

Compare the work each component performs

Rsyslog's parsing is not limited to a few regular expressions. Its modules can normalize structured data, and omelasticsearch can send directly to Elasticsearch. Logstash's plugin ecosystem may still be a better fit for a particular enrichment workflow.

Choose from a representative pipeline

For server syslog consolidation or network-device messages, begin with rsyslog if it already meets parsing and routing requirements. For application messages needing several transformations, test a Logstash pipeline with the intended filters and mappings.

Avoid comparing generic “messages per second” figures. Record size, regex complexity, output acknowledgements, batching, storage, and queue settings can change the result. Benchmark your samples through the actual destination and include an outage/recovery test. A low process memory figure without adequate buffering is not a reliability result.

The rsyslog forwarding reference and Logstash pipeline documentation describe the respective building blocks.

Combine them when each stage has a purpose

Host rsyslog → central rsyslog → Logstash → Elasticsearch

This can separate host collection from central parsing. It also adds a hop, configuration, queues, and another failure boundary. Agree on the wire format and framing between stages; a raw TCP syslog stream is not interchangeable with the Beats protocol.

Keep an existing rsyslog deployment if it already solves the collection problem. Add Logstash or a suitable collector such as DataKit only for a defined need: parsing, enrichment, destination integration, or operational visibility. Validate timestamps, host identity, error routes, and duplicate handling through the entire path before retiring an existing stage.