Beats (Filebeat, Metricbeat) in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Filebeat in the Elastic Stack?

Filebeat is a lightweight shipper that reads and forwards log files to Elasticsearch or Logstash for analysis. It is designed to be installed on servers to collect log data efficiently.

beginner

What is Metricbeat used for?

Metricbeat collects metrics from your systems and services, such as CPU usage, memory, and network statistics, and ships them to Elasticsearch for monitoring and visualization.

intermediate

How does Filebeat handle log files that are rotated or renamed?

Filebeat tracks files using a registry file to remember the last read position. When logs are rotated or renamed, Filebeat detects the changes and continues reading new data without duplication or loss.

beginner

Name two common modules available in Metricbeat.

Common Metricbeat modules include 'system' for OS-level metrics (CPU, memory, disk) and 'docker' for container metrics. Modules simplify collecting metrics from popular services.

intermediate

Why would you use Beats instead of directly sending logs or metrics from applications?

Beats are lightweight, easy to configure, and handle data collection reliably with features like backpressure and buffering. They reduce load on applications and centralize data shipping to Elasticsearch.

What type of data does Filebeat primarily collect?

A Log files

B System metrics

C Network packets

D Database records

Filebeat is designed to collect and ship log files from servers.

Which Beat would you use to monitor CPU and memory usage?

A Packetbeat

B Filebeat

C Metricbeat

D Winlogbeat

Metricbeat collects system and service metrics like CPU and memory usage.

How does Filebeat remember where it left off reading a log file?

A It stores position in Elasticsearch

B It uses a registry file

C It reads from the start every time

D It uses timestamps only

Filebeat uses a local registry file to track the last read position in each log file.

Which of these is NOT a feature of Beats?

A Direct database querying

B Modular data collection

C Backpressure handling

D Lightweight data shipping

Beats do not query databases directly; they collect logs or metrics.

Metricbeat modules help you to:

A Collect logs from files

B Store data in Elasticsearch

C Visualize data in Kibana

D Collect metrics from specific services

Metricbeat modules simplify collecting metrics from popular services like Docker or system metrics.

Explain the main differences between Filebeat and Metricbeat.

Think about what kind of data each Beat handles and why.

Describe how Filebeat ensures no log data is lost or duplicated during log rotation.

Consider how Filebeat remembers where it left off reading.