Beats Input

Beats are open-source data shippers that run as lightweight agents on your servers, purpose-built to collect and forward specific types of operational and security data. These single-purpose agents are developed primarily by Elastic and the open source community.

Each Beat is tailored to a specific use case. Consider the following examples:

Beat Name	Purpose
Filebeat	Ships log files (e.g. /var/log/*.log)
Winlogbeat	Ships Windows Event Logs
Metricbeat	Collects system and service metrics
Packetbeat	Captures and analyzes network traffic
Auditbeat	Monitors file integrity and audit logs
Community Beats	Specialized shippers created by the community

Hint: For easier management of your beats configuration, we recommend using Graylog Sidecar.

The Beats input in Graylog is designed to ingest log data directly from Beats data shippers and handle basic parsing of the incoming data. For most Beats, the logstash output works with the Graylog Beats input without additional configuration. However, some Beats may require custom settings to function correctly.

Prerequisites

Before proceeding, ensure that the following prerequisites are met:

To send data from Beats to Graylog, configure Beats to use the Logstash output plugin over TCP. This is compatible with the Beats input type in Graylog, which implements the same protocol used by Logstash Beats receivers.

Hint: The Graylog Beats input only supports TCP, not UDP. Always configure Beats to use TCP for output.

Input Type

This Input is a listener input type. See Inputs to learn about Input types.

Input Configuration

Follow the input setup instructions. During setup of this input, you can configure the following options:

Configuration Option	Description
Global (Checkbox)	Select this check box to enable this input on all Graylog nodes, or keep it unchecked to enable the input on a specific node.
Node	Select the node on which to start this input. If the Global check box is selected, this option is not available.
Bind Address	Enter the IP address the input binds to (e.g. 0.0.0.0 for all interfaces).
Port	Enter the port number on which Graylog listens for incoming messages.
Receive Buffer Size (optional)	This setting determines the size of the buffer that stores incoming data before it is processed. A larger buffer can accommodate more data, reducing the chance of data loss during high traffic periods. Depending on the amount of traffic being ingested by the input, this value should be large enough to ensure proper flow of data but small enough to prevent the system from spending resources trying to process the buffered data. The optimal size depends on your network traffic volume. Graylog's default setting is somewhat conservative at 256 KB for testing and small deployments, so if you are dealing with high volumes of NetFlow data, increasing this value is advised. A practical recommendation is to start with a buffer size of at least 1 MB (1024 KB) and adjust based on observed performance.
No. of worker threads (optional)	Specifies how many processing threads the input will use.
TLS cert file (optional)	The certificate file that is stored on a Graylog system. The value of this field is a path (`/path/to/file`) that Graylog should have access to, etc/graylog/tls (recommended). Ensure this path is readable by the user running the Graylog service.
TLS private key file (optional)	The certificate private key file that is stored on a Graylog system. The value of this field is a path (`/path/to/file`) that Graylog should have access to, etc/graylog/tls (recommended). Ensure this path is readable by the user running the Graylog service
Enable TLS (Checkbox)	Enable secure TLS for encrypted message transport (requires certificates).
TLS key password (optional)	The private key password.
TLS client authentication (optional)	Select your authentication preference from the drop down options.
TLS Client Auth Trusted Certs (optional)	The path where client (source) certificates are located on a Graylog system. The value of this field is a path (`/path/to/file`) to a file or a directory containing client certificates that Graylog should have access to, etc/graylog/tls (recommended). Ensure this is readable by the user running the Graylog service.
TCP keepalive (Checkbox)	Enable this option if you want the input to support TCP keep-alive packets to prevent idle connections.
Override Source (optional)	Allows you to override the source field for all incoming messages.
Encoding (optional)	All messages need to support the encoding configured for the input. For example, UTF-8 encoded messages should not be sent to an input configured to support UTF-16.
Do not add Beats type as prefix (Checkbox)	This option controls whether incoming Beats fields (like from Filebeat, Winlogbeat, etc.) get prefixed with the Beats type. If checked, fields remain as-is (e.g. source stays source). If unchecked, fields are prefixed with the Beats type (e.g. source → filebeat_source). Warning: Enabling this option will break Illuminate parsing.

Next Steps

After you complete input setup, visit Input Diagnosis for testing and validation of the new input. Use this functionality to help troubleshoot any connection issues.