Can someone explain Beats Architecture?

Elastic Stack Beats
1

Hello,

We're analysing the Beats for custom beat developments, and I was wondering if someone can explain the architecture under the hood?

I remember to see a diagram of it (from an old version) but was not able to find it anymore and imagine it changed significantly.

Thank you very much.

Best regards,
Carlos SOARES.

2

For 5.x releases have a look at this talk.

2 Likes
3

Hello,

Thank you very much!
Are there already some resources available for version 6.X?

Best regards,
Carlos SOARES.

4

No resources for 6.0 yet. Architecture is mostly the same (libbeat diagram is pretty high level :wink: ). Some common functionality has been moved to libbeat + output interfaces have been updated/simplified (somewhat internal API).

  • filebeat removes spooler + publisher workers (filebeat publishing has become async, making use of spooling/buffering in libbeat itself) -> libbeat notifies the registrar
  • winlogbeat 6.0 uses async publishing pipeline -> libbeat notifies registrar
  • no 'big' changes in metricbeat/haertbeat. Auditbeat uses metricbeat as framework
  • packetbeat no real change (I think flows publisher worker has been removed)
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.