Beats Input
Beats are open-source data shippers that run as lightweight agents on your servers, purpose-built to collect and forward specific types of operational and security data. These single-purpose agents are developed primarily by Elastic and the open source community. Each Beat is tailored to a specific use case and here are some examples:
| Beat Name | Purpose |
|---|---|
Filebeat
|
Ships log files (e.g., /var/log/*.log) |
Winlogbeat
|
Ships Windows Event Logs |
|
Collects system and service metrics |
|
Packetbeat
|
Captures and analyzes network traffic
|
Auditbeat
|
Monitors file integrity and audit logs |
|
Specialized shippers created by the community |
The Beats Input in Graylog is designed to ingest log data directly from Beats data shippers and handle basic parsing of the incoming data. For most Beats, the logstash output sends messages to Graylog and should work out of the box with the Graylog Beats input, but some might need to adjust settings.
Beats Output: Sending Logs to Graylog
To send data from Beats to Graylog, configure Beats to use the Logstash output plugin over TCP. This is compatible with the Beats input type in Graylog, which implements the same protocol used by Logstash Beats receivers.
TLS and Authentication
Graylog’s Beats input supports TLS encryption for secure log transport and can be configured to use client certificates for authentication. Refer to the TLS documentation for setup instructions.
See also:
