Better Stack Filebeat logging

Start logging in 6 minutes

Collect logs from your application using Filebeat.

1. Download and install Filebeat

Pick a version of Filebeat for your OS on Filebeat download page and install it.

2. Edit configuration

In your filebeat.yml file, replace current output.* config to send data to Better Stack:

output.elasticsearch:
  hosts: 'https://$INGESTING_HOST:443'
  path: '/elastic'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'

# Use this configuration for sources created before March 2025
output.elasticsearch:
  hosts: 'https://in-elasticsearch.logs.betterstack.com:443'
  headers:
    X-Better-Stack-Source-Token: '$SOURCE_TOKEN'

Review the rest of the config to ensure some logs will be read. For example, change enabled: false to enabled: true in the default filebeat.inputs array.

You can read more about input configuration in Filebeat docs.

3. Restart Filebeat

Restart Filebeat to reload the configuration:

systemctl restart filebeat

filebeat -e -c filebeat.yml

You should see your logs in Better Stack → Live tail.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏

Additional information

Want to read about Filebeat configuration in more detail?
Check out the Filebeat documentation.