# Better Stack Filebeat logging

## Start logging in 6 minutes

Collect logs from your application using [Filebeat](https://www.elastic.co/beats/filebeat).

### 1. Download and install Filebeat

Pick a version of Filebeat for your OS on [Filebeat download page](https://www.elastic.co/downloads/beats/filebeat) and install it.

### 2. Edit configuration

In your `filebeat.yml` file, **replace current `output.*` config** to send data to Better Stack:

```yaml
[label filebeat.yml output config]
output.elasticsearch:
  hosts: 'https://$INGESTING_HOST:443'
  path: '/elastic'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'
```

Review the rest of the config to **ensure some logs will be read**. For example, change `enabled: false` to `enabled: true` in the default `filebeat.inputs` array.

You can read more about input configuration in [Filebeat docs](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html).

### 3. Restart Filebeat

Restart Filebeat to reload the configuration:

[code-tabs]
```sh
[label Restart Filebeat service]
systemctl restart filebeat
```
```sh
[label Run Filebeat manually]
filebeat -e -c filebeat.yml
```
[/code-tabs]

You should see your logs in [Better Stack → Live tail](https://telemetry.betterstack.com/team/0/tail ";_blank").

## Need help?

Please let us know at hello@betterstack.com.  
We're happy to help! 🙏

## Additional information

Want to read about **Filebeat configuration** in more detail?  
Check out the [Filebeat documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuring-howto-filebeat.html).