Step 1 - Create the LogScale ingest token

Why? Filebeat authenticates to LogScale's Elasticsearch-compatible ingest endpoint by supplying the repository ingest token as the Elasticsearch output password.

Detailed steps:

The Filebeat Elasticsearch-output username is not used by LogScale for authentication. Note that this username can appear in proxy access logs, so always use a non-secret value such as a sender hostname.

Step 2 - Install Filebeat OSS

Why? LogScale requires the OSS distribution rather than Elastic's default non-OSS distribution.

Download Filebeat from Elastic's Filebeat OSS download page. Use Elastic's platform-specific installation instructions, but ensure that the package or repository URL points to the OSS distribution.

Linux package repositories

Elastic provides OSS APT/YUM package repositories. For current 9.x packages, the OSS repository path uses oss-9.x. If you intentionally deploy another validated major version, use the corresponding OSS repository.

Note: After installation, the standard Linux configuration file is:

/etc/filebeat/filebeat.yml

Windows

For the ZIP distribution, Elastic's Windows procedure extracts Filebeat under C:\Program Files\Filebeat and installs the Windows service by running install-service-filebeat.ps1 from an elevated PowerShell session:

cd 'C:\Program Files\Filebeat' 
.\install-service-filebeat.ps1

Take note of the filepaths that different versions of Filebeat use:

macOS / archive installs

Use the OSS archive for the required platform, extract it, and run Filebeat from the extracted directory according to Elastic's installation documentation.

Step 3 - Configure the log input

Why? The input tells Filebeat which files to monitor. LogScale's Filebeat integration is designed around Filebeat reading the source file and sending each resulting event through the Elasticsearch-compatible bulk API.

Example:

filebeat.inputs:
  - type: filestream
    id: application-logs
    enabled: true
    paths:
      - /var/log/application/*.log
    encoding: utf-8

Use the input type supported by your chosen Filebeat version. Current Elastic releases recommend filestream for file-based collection.

If you need multiline handling, configure it in Filebeat so related lines such as stack traces are combined before transmission.

Step 4 - Configure the LogScale output

Why? LogScale implements the part of the Elasticsearch bulk ingest API needed by Beats, allowing Filebeat's Elasticsearch output to send directly to LogScale.

Use the standard LogScale API endpoint where possible. A basic configuration is:

setup.ilm.enabled: false

output.elasticsearch:
  hosts: ["https://<YOUR_LOGSCALE_HOST>/api/v1/ingest/elastic-bulk"]
  username: "<NON_SECRET_USERNAME>"
  password: "<LOGSCALE_INGEST_TOKEN>"
  allow_older_versions: true

The exact host/port depends on your LogScale deployment. The standard, and preferred LogScale API path is /api/v1/ingest/elastic-bulk. The dedicated Elasticsearch-compatible port is 9200 for deployments that expose it.

Step 5 - Configure parsing and fields

Why? Filebeat transports the data, while LogScale parsers determine how the incoming event is structured.

CrowdStrike recommends assigning the parser to the ingest token. Alternatively, a parser/type can be supplied from Filebeat using a field on the input.

Do not rely on Filebeat's JSON parsing merely because the source is JSON. CrowdStrike recommends using LogScale's JSON parser where appropriate.

By default, LogScale's Filebeat handling retains only a subset of Filebeat-added fields and focuses on the source message. If your use case depends on the full set of fields added by Filebeat processors, review CrowdStrike's documented index/template configuration for retaining those fields.

Step 6 - Validate the Filebeat configuration

Before starting or restarting the service, validate the configuration with the Filebeat binary appropriate for your platform/version.

Then test connectivity to the configured output. If the output test reports Elasticsearch-version compatibility errors, confirm the required ILM and allow_older_versions settings and verify that you are using Filebeat OSS.

Step 7 - Start Filebeat

Linux service:

sudo systemctl enable filebeat
sudo systemctl restart filebeat
sudo systemctl status filebeat

Windows service:

Start-Service filebeat
Get-Service filebeat

For archive/manual installs, start Filebeat using the command appropriate for the extracted distribution and configuration location.

Step 8 - Verify ingestion

Optional Filebeat monitoring

Filebeat can expose an HTTP monitoring endpoint, commonly on port 5066 when enabled. Use it only if operational monitoring of Filebeat itself is required.