Beats：轻量级数据采集器

Beats are lightweight, single-purpose agents installed on your servers to collect data and ship it to Elasticsearch or Logstash. They use few resources, ideal for edge collection.

Each Beat targets one data type.

• Filebeat for log files
• Metricbeat for system and service metrics
• Packetbeat for network data
• Heartbeat for uptime checks

Beats sit at the source. They can ship directly to Elasticsearch, or to Logstash first when you need heavier parsing and enrichment.

Filebeat tails log files and forwards new lines. It tracks read position so it resumes after restarts without duplicating data.

For simple pipelines, point Filebeat straight at Elasticsearch.

When you need grok parsing or enrichment, send to Logstash instead.

Metricbeat collects metrics from the OS and from services through modules.

Beats ship with prebuilt modules that include parsing rules and ready-made Kibana dashboards, so you get visualizations without manual setup.

If the output is slow or down, Beats apply back pressure and buffer locally, slowing reads instead of dropping data.

Beats are light shippers; Logstash is a heavy processor. Use Beats at the edge for collection and Logstash centrally for transformation.

• Beats: low footprint, on every host
• Logstash: more CPU, fewer central nodes

Filebeat on each app server forwards logs to a Logstash pipeline that parses and enriches them before indexing in Elasticsearch for Kibana.

Choose the right Beat.

You learned that Beats are lightweight per-purpose shippers, that Filebeat handles logs and Metricbeat handles metrics, and that Beats can send directly to Elasticsearch or through Logstash for heavier parsing. Beats sit at the edge with a small footprint, complementing central Logstash processing.