The analysis of structured data is easier and helps us find meaningful/deeper analysis, rather than trying to perform analysis on unstructured data. Most analysis tools depend on structured data. Kibana, which we will be making use of for analysis and visualization, can be used effectively if the data in Elasticsearch is right (the information in the log data is loaded into appropriate fields, and the datatypes of the fields are more appropriate than just having all the values of the log data in a single field). 

Log data is typically made up of two parts, as follows:

logdata = timestamp + data

timestamp is the time when the event occurred and data is the information about the event. data may contain just a single piece of information or it may contain many pieces of information. For example, if we take apache-access logs, the data piece will contain the response code, request URL, IP address, and so on. We would need to have a mechanism for extracting this information from the data and thus converting the unstructured data/event into a structured data/event. This is where the filter section of the Logstash pipeline comes in handy. The filter section is made up of one or more filter plugins that assist in parsing and enriching the log data.