Beats

Fluxtail accepts Lumberjack v2 from Filebeat and Elastic Agent through the Logstash output. It supports window, JSON, and zlib-compressed frames with cumulative acknowledgement after publish.

Prerequisites

Create a Beats receiver, add the sender’s public IPv4 or CIDR, wait for active, and copy its exact hostname and assigned port.

Filebeat configuration

filebeat.inputs:
  - type: filestream
    id: app-logs
    paths:
      - /var/log/my-app/*.log

output.logstash:
  hosts:
    - "${FLUXTAIL_BEATS_HOST}:${FLUXTAIL_BEATS_PORT}"
  ssl.enabled: true
  ssl.verification_mode: full
  compression_level: 3
  pipelining: 2
  bulk_max_size: 2048

For a first test, use pipelining: 0, compression_level: 0, and bulk_max_size: 2. Raise batching after logs arrive.

Verify

Run filebeat test output, start Filebeat, then search Live Tail for a known line from /var/log/my-app/*.log.

Troubleshooting

• Keep public CA and hostname checks enabled.
• If using a private CA, configure ssl.certificate_authorities; do not disable verification.
• Lumberjack v1 and client-certificate authentication are not supported.
• Confirm endpoint state, source IPv4 rules, and outbound TCP access.