Filebeat

Filebeat is a lightweight shipper from Elastic that forwards and centralizes log data from servers, containers, and applications. As part of the Elastic Beats family, Filebeat monitors log files or locations, collects log events, and forwards them to specified outputs.

Filebeat is designed with minimal resource consumption in mind, making it suitable for deployment on production systems without significant performance impact. It includes built-in modules for common log formats including Apache, Nginx, MySQL, and system logs.

Data Flow

The following diagram shows how Filebeat forwards logs through Log Collector's ingestion pipeline:

flowchart LR A[Log Files] --> B[Filebeat Agent] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[JSON Parser] D --> D2[Regex Parser] D --> D3[Multi-line Parser] D --> D4[Filebeat Module Parsers] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]
flowchart LR A[Log Files] --> B[Filebeat Agent] B --> C[LogScale HTTP Endpoint] C --> D[Parser Pipeline] subgraph "Parser Types" D --> D1[JSON Parser] D --> D2[Regex Parser] D --> D3[Multi-line Parser] D --> D4[Filebeat Module Parsers] end D1 & D2 & D3 & D4 --> E[Compression] E --> F[Repository Storage]

Organizations migrating from Elastic Stack can leverage their existing Filebeat deployments by reconfiguring the output to send data to LogScale's Elasticsearch Bulk API endpoint.