Filebeat is a log file shipping tool, installed on the server as an agent, filebeat will monitor the log directory or specified log files, track and read these files (track file changes, read continuously), and forward the information to Stored in elasticsearch or logsarsh.
Filebeat consists of two main components, prospectors and harvesters.
Prospectors are responsible for managing all harvesters and discovering all log sources that need to be read.
If the input source is log, prospectors find all matching log files on the drive according to the configured path and start a harvester for each file.
Harvesters are responsible for reading the log file line by line and sending the contents to the specified output.
Filebeat currently supports two prospector types, log and stdin, each of which can be defined multiple times.
Filebeat Architecture Diagram
Filebeat typical application