Beats

Fluxtail accepts Lumberjack v2 from Filebeat and Elastic Agent through the Logstash output. It supports window, JSON, and zlib-compressed frames with cumulative acknowledgement after publish.

Prerequisites

Create a Beats receiver, add the sender’s public IPv4 or CIDR, wait for active, and copy its exact hostname and assigned port.

Filebeat configuration

filebeat.inputs:
  - type: filestream
    id: app-logs
    paths:
      - /var/log/my-app/*.log

output.logstash:
  hosts:
    - "${FLUXTAIL_BEATS_HOST}:${FLUXTAIL_BEATS_PORT}"
  ssl.enabled: true
  ssl.verification_mode: full
  compression_level: 3
  pipelining: 2
  bulk_max_size: 2048

For a first test, use pipelining: 0, compression_level: 0, and bulk_max_size: 2. Raise batching after logs arrive.

Verify

Run filebeat test output, start Filebeat, then search Live Tail for a known line from /var/log/my-app/*.log.

Troubleshooting

• Keep public CA and hostname checks enabled.
• If using a private CA, configure ssl.certificate_authorities; do not disable verification.
• Lumberjack v1 and client-certificate authentication are not supported.
• Confirm endpoint state, source IPv4 rules, and outbound TCP access.

Next steps

Tune batching only after the first records are visible, then use search and filters to confirm the fields you need. See Elastic’s official Filebeat Logstash output reference for the sender options.