Beats is a collection of lightweight data shippers written in Go that form a core component of the Elastic Stack. The project provides a framework called libbeat along with seven officially supported Beat applications, each designed to collect specific types of operational data from servers and send it to Elasticsearch or Logstash for visualization and analysis in Kibana. The repository emphasizes minimal resource consumption, small installation footprints, and zero runtime dependencies as defining characteristics of the Beats architecture.
The officially supported Beats included in this repository serve distinct data collection purposes. Filebeat tails and ships log files from various sources. Metricbeat fetches metrics from operating systems and services. Packetbeat monitors networks and applications through packet sniffing. Heartbeat pings remote services to verify availability. Auditbeat collects Linux audit framework data and monitors file integrity. Winlogbeat specifically handles Windows Event logs. Osquerybeat, available in the x-pack directory, runs Osquery and manages its interactions. Beyond these official implementations, the project acknowledges a community ecosystem of additional Beats built on the libbeat framework that exist outside this repository.
The repository demonstrates substantial organizational activity and engagement.
The project's scope extends across multiple infrastructure and observability domains. This broad classification reflects the diverse use cases enabled by the various Beat implementations and their flexibility in different deployment scenarios.
The repository maintains connections with other significant Elastic projects. The project provides comprehensive documentation on the elastic.co site for each Beat implementation and the libbeat platform itself, along with getting started guides. The repository includes contribution guidelines in a CONTRIBUTING file and special instructions for AI coding agents in an AGENTS.md file. Pre-compiled binaries and packages for supported platforms are available through Elastic's downloads page, and snapshot builds generated from the main branch are provided for testing purposes. The project uses Buildkite for CI/CD pipelines with support for PR-triggered jobs and label-based build configuration for affiliated Elastic users.
