Filebeat
| Typically Used By | Organizations needing lightweight log shipping; Simple log forwarding needs |
| Description | A lightweight, resource-efficient log shipper that forwards and centralizes log data from files with minimal overhead. |
| Official Vendor Documentation | https://www.elastic.co/docs/reference/beats/filebeat |
| Setup Difficulty | 3 (Moderate) |
| Useful for | DevOps , IT Ops |
| Primary Use Case | File log shipping |
| Scenarios not Recommended | Complex parsing requirements; Environments needing extensive transformation |
| Data Volume Handling | Medium |
| Authentication Method | Token-based |
| Fault Tolerance | Medium |
| Additional Tools Required | None |
Filebeat is a lightweight shipper from Elastic that forwards and centralizes log data from servers, containers, and applications. As part of the Elastic Beats family, Filebeat monitors log files or locations you specify, collects log events, and forwards them to designated outputs.
Use Filebeat OSS (Open Source Software) to monitor log files and send events directly to Falcon LogScale Collector through LogScale's Elasticsearch-compatible bulk ingest API. Filebeat uses its built-in Elasticsearch output, with the LogScale ingest token supplied as the output password architectures.
Filebeat ingest flowThe following diagram shows how Filebeat log data flows through Log Collector's ingestion pipeline, highlighting specific parser types applied to the log data before data is compressed, stored in the repository, and indexed for searching:
Important compatibility requirement
The Elastic, non-OSS distribution of Filebeat does not work with LogScale, so always use the Filebeat OSS distribution.
CrowdStrike recommends the latest available OSS Beats release.
For Filebeat 8.0 and later, LogScale requires
setup.ilm.enabled: falseFor Filebeat 8.1 and later, LogScale also requires
output.elasticsearch.allow_older_versions: true
Before you begin
Identify the LogScale repository that will receive the events.
Create or identify a parser appropriate for the log source.
Create an ingest token for the repository and assign the parser to the token where practical.
Identify the LogScale hostname/URL and confirm outbound HTTPS connectivity from the Filebeat host.
Identify the log file paths and text encoding.
Choose and validate the Filebeat OSS version you will deploy.