Explore documentation
  1. Welcome to Telemetry 👋
  2. Quick start guide
  3. Wide events vs. time series
  4. Ingesting data
    1. Better Stack collector
    2. Vector
    3. OpenTelemetry
    4. Ingesting via HTTP API
    5. Ingesting metrics
    6. Ingesting logs
      1. Docker & Kubernetes
      2. Operating systems
      3. Log forwarders
        1. Vector
        2. Syslog
        3. Fluent Bit
        4. Fluentd
        5. Filebeat
        6. Logstash
      4. Programming languages
      5. Cloud platforms
      6. Web servers & Load balancers
      7. Databases & queues
      8. Storage
    7. Migrating to Better Stack
  5. Using the product
    1. Transforming ingested data
    2. Querying data
    3. Tracing
    4. Alerts
  6. Telemetry API
    1. Getting an API token
    2. Sources
    3. Metrics API
    4. Query API ↗
  7. Alternative to
    1. Lightstep

Better Stack Filebeat logging

Start logging in 6 minutes

Collect logs from your application using Filebeat.

Want to start logging from a Windows machine?

The configuration for Filebeat is generally compatible with Winlogbeat, which is specifically built to collect your Windows event logs.

You can download Winlogbeat and use the same output configuration.

1. Download and install Filebeat

Pick a version of Filebeat for your OS on Filebeat download page and install it.

2. Edit configuration

In your filebeat.yml file, replace current output.* config to send data to Better Stack:

filebeat.yml output config legacy output config 
output.elasticsearch:
  hosts: 'https://$INGESTING_HOST:443'
  path: '/elastic'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'
# Use this configuration for sources created before March 2025
output.elasticsearch:
  hosts: 'https://in-elasticsearch.logs.betterstack.com:443'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'

Review the rest of the config to ensure some logs will be read. For example, change enabled: false to enabled: true in the default filebeat.inputs array.

You can read more about input configuration in Filebeat docs.

3. Restart Filebeat

Restart Filebeat to reload the configuration:

Restart Filebeat service Run Filebeat manually 
systemctl restart filebeat
filebeat -e -c filebeat.yml

You should see your logs in Better Stack → Live tail.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏

Additional information

Want to read about Filebeat configuration in more detail?
Check out the Filebeat documentation.

Previous article

Send logs to Better Stack using Fluentd

Next article

Send logs to Better Stack using Logstash