These tools (-elasticsearch) run on a server that's usually connected to a network tap that collects traffic from endpoints and servers alike.

Running them locally, a tap, and a server are unnecessary.