---
title: Filebeat
description: Lightweight Shipper for Logs
breadcrumbs: Docs > Integrations > Filebeat
---

# Filebeat
Supported OS Integration version1.3.1
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Get metrics from Filebeat service in real time to:

- Visualize and monitor Filebeat states.
- Be notified about Filebeat failovers and events.

## Setup{% #setup %}

The Filebeat check is not included in the [Datadog Agent](https://app.datadoghq.com/account/settings/agent/latest) package, so you need to install it.

### Installation{% #installation %}

For Agent v7.21+ / v6.21+, follow the instructions below to install the Filebeat check on your host. See [Use Community Integrations](https://docs.datadoghq.com/agent/guide/use-community-integrations.md) to install with the Docker Agent or earlier versions of the Agent.

1. Run the following command to install the Agent integration:

   ```shell
   datadog-agent integration install -t datadog-filebeat==<INTEGRATION_VERSION>
   ```

1. Configure your integration similar to core [integrations](https://docs.datadoghq.com/getting_started/integrations.md).

### Configuration{% #configuration %}

1. Edit the `filebeat.d/conf.yaml` file in the `conf.d/` folder at the root of your [Agent's configuration directory](https://docs.datadoghq.com/agent/guide/agent-configuration-files.md#agent-configuration-directory) to start collecting your Filebeat metrics. See the [sample filebeat.d/conf.yaml](https://github.com/DataDog/integrations-extras/blob/master/filebeat/datadog_checks/filebeat/data/conf.yaml.example) for all available configuration options.

1. [Restart the Agent](https://docs.datadoghq.com/agent/guide/agent-commands.md#start-stop-and-restart-the-agent)

## Validation{% #validation %}

Run the [Agent's status subcommand](https://docs.datadoghq.com/agent/guide/agent-commands.md#service-status) and look for `filebeat` under the Checks section.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

|  |
|  |
| **filebeat.registry.unprocessed\_bytes**(gauge) | Number of bytes not processed by filebeat yet.*Shown as byte* |

### Events{% #events %}

The Filebeat check does not include any events.

### Service Checks{% #service-checks %}

**filebeat.can\_connect**

Returns `Critical` if the Agent cannot connect to Filebeat to collect metrics, returns `OK` otherwise.

*Statuses: ok, critical*

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).