Filebeat is an open-source file harvester developed by Elastic, primarily designed to fetch log files and feed them into Logstash. It serves as a lightweight agent for collecting data from various sources, making it an essential tool for system administrators and developers who need efficient log management. Together with the libbeat lumberjack output, it acts as a replacement for logstash-forwarder, streamlining the process of shipping logs to central collection points.
Key features:
- Open-source file harvester for fetching and shipping log files.
- Feeds collected data directly into Logstash for processing.
- Supports GCP Pub/Sub input with an api_endpoint configuration option.
- Filestream take_over feature allows migration from any previous filestream input.
- Optimized UDP and Unix datagram read buffer reuse to reduce memory allocation.
- Includes add_kubernetes_metadata processor with an append_fields option.
- Efficient add_agent_metadata processor with pre-built static metadata maps.
- Compatible with the Elastic-2.0 license for flexible deployment.
What's new in version 9.5.5:
- Updated Go to version 1.26.8.
- Added api_endpoint configuration option to the gcp-pubsub input.
- Filestream take_over now supports from_any_id for easier migration.
- Improved buffer reuse for UDP and Unix datagram packets.
- Added append_fields option to the add_kubernetes_metadata processor.
- Reduced per-event allocations in the add_agent_metadata processor.
- Fixed Elasticsearch state store writing issues for inputs of the same type.
- Resolved race conditions in the Kafka input when multiple inputs are active.