How elastic/beats works
Beats is a family of lightweight operational-data shippers built on libbeat: each Beat gathers a different kind of data, forms events, and publishes them toward Elasticsearch or Logstash. The graph shows the shared event path and the distinct collection stages documented in the README. The file tree supports representative collection and pipeline paths, but not every Beat’s wiring was sampled, so subsystem links are limited to the documented product workflow.
Main entry points: pipeline.go Publisher pipeline · cmd Beat command · beater Filebeat · input Log inputs
Components 19
Runtime startup
- Configuration
libbeat/cfgfile - Beat command
libbeat/cmd
Log collection
- Filebeat
filebeat/beater - Log inputs
filebeat/input - Harvesters
filebeat/harvester
Monitoring and audit
- Auditbeat
auditbeat/module - File integrity
auditbeat/module/file_integrity - Heartbeat
heartbeat/monitors - Metricbeat
metricbeat/module - Packetbeat
packetbeat/module - Winlogbeat
winlogbeat/module - Osquerybeat
x-pack/osquerybeat/beater
Shared event framework
- Autodiscover
libbeat/autodiscover - Event processing
libbeat/beat/pipeline.go - Publisher pipeline
libbeat/publisher/pipeline/pipeline.go - Fileset pipelines
filebeat/fileset/pipelines.go
Event delivery
- Elasticsearch
- Logstash
Other components
- Operator
Connections 24
- Operator → Beat command: starts
- Configuration → Beat command: configures
- Beat command → Filebeat: runs
- Beat command → Auditbeat: runs
- Beat command → Heartbeat: runs
- Beat command → Metricbeat: runs
- Beat command → Packetbeat: runs
- Beat command → Winlogbeat: runs
- Beat command → Osquerybeat: runs
- Filebeat → Log inputs: starts inputs
- Log inputs → Harvesters: reads logs
- Harvesters → Publisher pipeline: publishes events
- Auditbeat → File integrity: monitors files
- File integrity → Publisher pipeline: publishes events
- Heartbeat → Publisher pipeline: publishes checks
- Metricbeat → Publisher pipeline: publishes metrics
- Packetbeat → Publisher pipeline: publishes packets
- Winlogbeat → Publisher pipeline: publishes events
- Osquerybeat → Publisher pipeline: publishes results
- Autodiscover → Filebeat: configures inputs
- Publisher pipeline → Event processing: processes events
- Publisher pipeline → Elasticsearch: sends events
- Publisher pipeline → Logstash: sends events
- Fileset pipelines → Elasticsearch: loads ingest pipelines