# elastic/beats architecture

> Architecture diagram of the GitHub repository elastic/beats, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/elastic/beats
- Repository: https://github.com/elastic/beats

## Overview

Beats is a family of lightweight operational-data shippers built on libbeat: each Beat gathers a different kind of data, forms events, and publishes them toward Elasticsearch or Logstash. The graph shows the shared event path and the distinct collection stages documented in the README. The file tree supports representative collection and pipeline paths, but not every Beat’s wiring was sampled, so subsystem links are limited to the documented product workflow.

Main entry points: [`libbeat/publisher/pipeline/pipeline.go`](https://github.com/elastic/beats/blob/main/libbeat/publisher/pipeline/pipeline.go) (Publisher pipeline), [`libbeat/cmd`](https://github.com/elastic/beats/tree/main/libbeat/cmd) (Beat command), [`filebeat/beater`](https://github.com/elastic/beats/tree/main/filebeat/beater) (Filebeat), [`filebeat/input`](https://github.com/elastic/beats/tree/main/filebeat/input) (Log inputs)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_runtime["Runtime startup"]
  node_configuration["Configuration"]
  node_beatcmd["Beat command"]
end

subgraph group_logs["Log collection"]
  node_filebeat["Filebeat"]
  node_loginputs["Log inputs"]
  node_harvester["Harvesters"]
end

subgraph group_observers["Monitoring and audit"]
  node_auditbeat["Auditbeat"]
  node_fileintegrity["File integrity"]
  node_heartbeat["Heartbeat"]
  node_metricbeat["Metricbeat"]
  node_packetbeat["Packetbeat"]
  node_winlogbeat["Winlogbeat"]
  node_osquerybeat["Osquerybeat"]
end

subgraph group_framework["Shared event framework"]
  node_autodiscover["Autodiscover"]
  node_processors["Event processing<br/>[pipeline.go]"]
  node_pipeline["Publisher pipeline<br/>[pipeline.go]"]
  node_filemodules["Fileset pipelines<br/>[pipelines.go]"]
end

subgraph group_delivery["Event delivery"]
  node_elasticsearch[("Elasticsearch")]
  node_logstash["Logstash"]
end

node_operator(("Operator"))

node_operator -->|"starts"| node_beatcmd
node_configuration -->|"configures"| node_beatcmd
node_beatcmd -->|"runs"| node_filebeat
node_beatcmd -->|"runs"| node_auditbeat
node_beatcmd -->|"runs"| node_heartbeat
node_beatcmd -->|"runs"| node_metricbeat
node_beatcmd -->|"runs"| node_packetbeat
node_beatcmd -->|"runs"| node_winlogbeat
node_beatcmd -->|"runs"| node_osquerybeat
node_filebeat -->|"starts inputs"| node_loginputs
node_loginputs -->|"reads logs"| node_harvester
node_harvester -->|"publishes events"| node_pipeline
node_auditbeat -->|"monitors files"| node_fileintegrity
node_fileintegrity -->|"publishes events"| node_pipeline
node_heartbeat -->|"publishes checks"| node_pipeline
node_metricbeat -->|"publishes metrics"| node_pipeline
node_packetbeat -->|"publishes packets"| node_pipeline
node_winlogbeat -->|"publishes events"| node_pipeline
node_osquerybeat -->|"publishes results"| node_pipeline
node_autodiscover -->|"configures inputs"| node_filebeat
node_pipeline -->|"processes events"| node_processors
node_pipeline -->|"sends events"| node_elasticsearch
node_pipeline -->|"sends events"| node_logstash
node_filemodules -->|"loads ingest pipelines"| node_elasticsearch

click node_configuration "https://github.com/elastic/beats/tree/main/libbeat/cfgfile"
click node_beatcmd "https://github.com/elastic/beats/tree/main/libbeat/cmd"
click node_filebeat "https://github.com/elastic/beats/tree/main/filebeat/beater"
click node_loginputs "https://github.com/elastic/beats/tree/main/filebeat/input"
click node_harvester "https://github.com/elastic/beats/tree/main/filebeat/harvester"
click node_auditbeat "https://github.com/elastic/beats/tree/main/auditbeat/module"
click node_fileintegrity "https://github.com/elastic/beats/tree/main/auditbeat/module/file_integrity"
click node_heartbeat "https://github.com/elastic/beats/tree/main/heartbeat/monitors"
click node_metricbeat "https://github.com/elastic/beats/tree/main/metricbeat/module"
click node_packetbeat "https://github.com/elastic/beats/tree/main/packetbeat/module"
click node_winlogbeat "https://github.com/elastic/beats/tree/main/winlogbeat/module"
click node_osquerybeat "https://github.com/elastic/beats/tree/main/x-pack/osquerybeat/beater"
click node_autodiscover "https://github.com/elastic/beats/tree/main/libbeat/autodiscover"
click node_processors "https://github.com/elastic/beats/blob/main/libbeat/beat/pipeline.go"
click node_pipeline "https://github.com/elastic/beats/blob/main/libbeat/publisher/pipeline/pipeline.go"
click node_filemodules "https://github.com/elastic/beats/blob/main/filebeat/fileset/pipelines.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_configuration,node_beatcmd toneBlue
class node_filebeat,node_loginputs,node_harvester toneAmber
class node_auditbeat,node_fileintegrity,node_heartbeat,node_metricbeat,node_packetbeat,node_winlogbeat,node_osquerybeat toneMint
class node_autodiscover,node_processors,node_pipeline,node_filemodules toneRose
class node_elasticsearch,node_logstash,node_operator toneIndigo
```

## Components

### Runtime startup

- [Configuration](https://github.com/elastic/beats/tree/main/libbeat/cfgfile): `libbeat/cfgfile`
- [Beat command](https://github.com/elastic/beats/tree/main/libbeat/cmd): `libbeat/cmd`

### Log collection

- [Filebeat](https://github.com/elastic/beats/tree/main/filebeat/beater): `filebeat/beater`
- [Log inputs](https://github.com/elastic/beats/tree/main/filebeat/input): `filebeat/input`
- [Harvesters](https://github.com/elastic/beats/tree/main/filebeat/harvester): `filebeat/harvester`

### Monitoring and audit

- [Auditbeat](https://github.com/elastic/beats/tree/main/auditbeat/module): `auditbeat/module`
- [File integrity](https://github.com/elastic/beats/tree/main/auditbeat/module/file_integrity): `auditbeat/module/file_integrity`
- [Heartbeat](https://github.com/elastic/beats/tree/main/heartbeat/monitors): `heartbeat/monitors`
- [Metricbeat](https://github.com/elastic/beats/tree/main/metricbeat/module): `metricbeat/module`
- [Packetbeat](https://github.com/elastic/beats/tree/main/packetbeat/module): `packetbeat/module`
- [Winlogbeat](https://github.com/elastic/beats/tree/main/winlogbeat/module): `winlogbeat/module`
- [Osquerybeat](https://github.com/elastic/beats/tree/main/x-pack/osquerybeat/beater): `x-pack/osquerybeat/beater`

### Shared event framework

- [Autodiscover](https://github.com/elastic/beats/tree/main/libbeat/autodiscover): `libbeat/autodiscover`
- [Event processing](https://github.com/elastic/beats/blob/main/libbeat/beat/pipeline.go): `libbeat/beat/pipeline.go`
- [Publisher pipeline](https://github.com/elastic/beats/blob/main/libbeat/publisher/pipeline/pipeline.go): `libbeat/publisher/pipeline/pipeline.go`
- [Fileset pipelines](https://github.com/elastic/beats/blob/main/filebeat/fileset/pipelines.go): `filebeat/fileset/pipelines.go`

### Event delivery

- **Elasticsearch**
- **Logstash**

### Other components

- **Operator**

## Connections

- Operator → Beat command: starts
- Configuration → Beat command: configures
- Beat command → Filebeat: runs
- Beat command → Auditbeat: runs
- Beat command → Heartbeat: runs
- Beat command → Metricbeat: runs
- Beat command → Packetbeat: runs
- Beat command → Winlogbeat: runs
- Beat command → Osquerybeat: runs
- Filebeat → Log inputs: starts inputs
- Log inputs → Harvesters: reads logs
- Harvesters → Publisher pipeline: publishes events
- Auditbeat → File integrity: monitors files
- File integrity → Publisher pipeline: publishes events
- Heartbeat → Publisher pipeline: publishes checks
- Metricbeat → Publisher pipeline: publishes metrics
- Packetbeat → Publisher pipeline: publishes packets
- Winlogbeat → Publisher pipeline: publishes events
- Osquerybeat → Publisher pipeline: publishes results
- Autodiscover → Filebeat: configures inputs
- Publisher pipeline → Event processing: processes events
- Publisher pipeline → Elasticsearch: sends events
- Publisher pipeline → Logstash: sends events
- Fileset pipelines → Elasticsearch: loads ingest pipelines