Beats (Filebeat, Metricbeat) in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Filebeat in the Elastic Stack?

Filebeat is a lightweight shipper that reads and forwards log files to Elasticsearch or Logstash for analysis. It is designed to be installed on servers to collect log data efficiently.

beginner

What is Metricbeat used for?

Metricbeat collects metrics from your systems and services, such as CPU usage, memory, and network statistics, and ships them to Elasticsearch for monitoring and visualization.

intermediate

How does Filebeat handle log files that are rotated or renamed?

Filebeat tracks files using a registry file to remember the last read position. When logs are rotated or renamed, Filebeat detects the changes and continues reading new data without duplication or loss.

beginner

Name two common modules available in Metricbeat.

Common Metricbeat modules include 'system' for OS-level metrics (CPU, memory, disk) and 'docker' for container metrics. Modules simplify collecting metrics from popular services.

intermediate

Why would you use Beats instead of directly sending logs or metrics from applications?

Beats are lightweight, easy to configure, and handle data collection reliably with features like backpressure and buffering. They reduce load on applications and centralize data shipping to Elasticsearch.

What type of data does Filebeat primarily collect?

A Log files

B System metrics

C Network packets

D Database records

Filebeat is designed to collect and ship log files from servers.

Which Beat would you use to monitor CPU and memory usage?

A Packetbeat

B Filebeat

C Metricbeat

D Winlogbeat

Metricbeat collects system and service metrics like CPU and memory usage.

How does Filebeat remember where it left off reading a log file?

A It stores position in Elasticsearch

B It uses a registry file

C It reads from the start every time

D It uses timestamps only

Filebeat uses a local registry file to track the last read position in each log file.

Which of these is NOT a feature of Beats?

A Direct database querying

B Modular data collection

C Backpressure handling

D Lightweight data shipping

Beats do not query databases directly; they collect logs or metrics.

Metricbeat modules help you to:

A Collect logs from files

B Store data in Elasticsearch

C Visualize data in Kibana

D Collect metrics from specific services

Metricbeat modules simplify collecting metrics from popular services like Docker or system metrics.

Explain the main differences between Filebeat and Metricbeat.

Think about what kind of data each Beat handles and why.

Describe how Filebeat ensures no log data is lost or duplicated during log rotation.

Consider how Filebeat remembers where it left off reading.

Practice

1. What is the primary purpose of Filebeat in the Elastic Stack?

easy

A. To visualize data in dashboards

B. To collect system metrics like CPU and memory usage

C. To collect and ship log files from servers

D. To store data in Elasticsearch

Solution

1. Step 1: Understand Filebeat's role

   Filebeat is designed to collect log files from servers and forward them.

2. Step 2: Differentiate from Metricbeat

   Metricbeat collects system metrics, not logs.

3. Final Answer:

   To collect and ship log files from servers -> Option C

4. Quick Check:

   Filebeat = log collection [OK]

Hint: Filebeat = logs, Metricbeat = metrics [OK]

Common Mistakes:

• Confusing Filebeat with Metricbeat
• Thinking Filebeat visualizes data
• Assuming Filebeat stores data

2. Which of the following is the correct syntax to start Filebeat on a Linux system?

easy

A. sudo systemctl start filebeat

B. filebeat run start

C. start filebeat service

D. service filebeat enable

Solution

1. Step 1: Identify standard Linux service start command

   On modern Linux systems, services are started with 'sudo systemctl start servicename'.

2. Step 2: Match with Filebeat service

   Filebeat service is named 'filebeat', so the command is 'sudo systemctl start filebeat'.

3. Final Answer:

   sudo systemctl start filebeat -> Option A

4. Quick Check:

   systemctl start filebeat = correct syntax [OK]

Hint: Use systemctl to manage services on Linux [OK]

Common Mistakes:

• Using incorrect command order
• Confusing 'start' with 'enable'
• Using non-standard service commands

3. Given this Filebeat configuration snippet:

filebeat.inputs:
- type: log
  paths:
    - /var/log/syslog
output.elasticsearch:
  hosts: ["localhost:9200"]

What will Filebeat do when started?

medium

A. Store logs locally without sending

B. Collect system metrics and send to Elasticsearch

C. Send logs to a remote Logstash server

D. Collect logs from /var/log/syslog and send to Elasticsearch at localhost:9200

Solution

1. Step 1: Analyze input configuration

   The input type is 'log' and path is '/var/log/syslog', so Filebeat collects logs from this file.

2. Step 2: Analyze output configuration

   Output is set to Elasticsearch at 'localhost:9200', so logs are sent there.

3. Final Answer:

   Collect logs from /var/log/syslog and send to Elasticsearch at localhost:9200 -> Option D

4. Quick Check:

   Input logs + output Elasticsearch = Collect logs from /var/log/syslog and send to Elasticsearch at localhost:9200 [OK]

Hint: Check input type and output host to predict behavior [OK]

Common Mistakes:

• Confusing logs with metrics
• Assuming output is Logstash
• Ignoring the paths setting

4. You configured Metricbeat to collect CPU metrics but see no data in Elasticsearch. Which of these is a likely cause?

medium

A. Metricbeat service is not running

B. Filebeat is collecting logs instead of metrics

C. Elasticsearch is not installed

D. Metricbeat configuration file is empty

Solution

1. Step 1: Check Metricbeat service status

   If Metricbeat is not running, it cannot collect or send metrics.

2. Step 2: Consider other options

   Filebeat collecting logs is unrelated; Elasticsearch not installed would cause errors; empty config would cause no collection.

3. Final Answer:

   Metricbeat service is not running -> Option A

4. Quick Check:

   Service running = data sent [OK]

Hint: Always verify Metricbeat service is active [OK]

Common Mistakes:

• Mixing Filebeat and Metricbeat roles
• Ignoring service status
• Assuming Elasticsearch absence without error

5. You want to monitor both system logs and CPU metrics on a server using Beats. Which setup is best?

hard

A. Run Filebeat and Metricbeat but send data to different Elasticsearch clusters

B. Run Filebeat for logs and Metricbeat for CPU metrics, both sending to Elasticsearch

C. Run Metricbeat for logs and Filebeat for metrics

D. Run only Filebeat configured for logs and metrics

Solution

1. Step 1: Identify Beats roles

   Filebeat collects logs; Metricbeat collects system metrics like CPU.

2. Step 2: Choose correct combination

   Running both Beats with their proper roles and sending data to the same Elasticsearch cluster is best for unified monitoring.

3. Final Answer:

   Run Filebeat for logs and Metricbeat for CPU metrics, both sending to Elasticsearch -> Option B

4. Quick Check:

   Filebeat = logs + Metricbeat = metrics [OK]

Hint: Use Filebeat for logs and Metricbeat for metrics together [OK]

Common Mistakes:

• Mixing roles of Filebeat and Metricbeat
• Sending data to separate clusters unnecessarily
• Assuming one Beat can do both well