+++
title = "Using Filebeat with Bonsai"
weight = 134
updated = 2023-07-07
aliases = ["/docs/using-filebeat-with-bonsai", "/docs/managed-search/elasticsearch-and-opensearch/cluster-management/integrations/filebeat/", "/docs/cluster-management/integrations/filebeat/"]

[extra]
nav_title = "Filebeat"
weight = 51
+++

[Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html) is a lightweight shipper for
forwarding and centralizing log data. It monitors the log files or locations that you specify, collects log events, and
forwards them to [Elasticsearch](https://www.elastic.co/products/elasticsearch) for indexing. A common question is whether Bonsai offers support for it.

The answer is a qualified “yes.” Filebeat is a server-side tool, meaning it runs outside of Bonsai's infrastructure and
Bonsai is not involved in its configuration or management. But as a host, Bonsai is not opinionated about where your
cluster's data comes from. So if you have Filebeat running on your servers, you can configure an output to your Bonsai
cluster, and it will work.

To connect Filebeat to a Bonsai cluster you just need to add your Bonsai URL to the filebeat.yml file like this:

```yaml
output.elasticsearch:
  hosts: [ "wp-play-8646224217.us-east-1.bonsaisearch.net:443" ]
  protocol: "https"
  username: "aaa" # The randomly-generated username for your cluster
  password: "xxx" # The randomly-generated password for your cluster
```

## Autocreation and Bonsai

If an application sends data to an index which does not exist, Elasticsearch will create that index and assume its
mappings from the data in the payload. This feature is called autocreation, and it is supported in a limited capacity on
Bonsai. Certain base names can be used for autocreation. Those base names are:

* .kibana
* events
* filebeat
* kibana-int
* logstash
* requests

This means your Filebeat index must start with one of these index names, or it will not be automatically created.

It is important to note that Filebeat requires the OSS distribution of Elasticsearch, so for this process to work the
[OSS version of Filebeat](https://www.elastic.co/downloads/beats/filebeat-oss) needs to be used.