Skip to main content

​
Forwarding Command

Use beacon endpoint elastic to generate Elastic integration content for Beacon endpoint events. The generated pack tails Beacon’s local runtime.jsonl file with Filebeat or standalone Elastic Agent and installs Elasticsearch/Kibana assets around the logs-beacon.endpoint-* data stream pattern. Beacon does not store Elastic cluster URLs or credentials. Keep ES_HOSTS, ES_API_KEY, usernames, passwords, and TLS settings in Filebeat, Elastic Agent, or your endpoint-management secret store.
Command syntax

​
Commands

beacon endpoint elastic print-config

Print a Filebeat config for the configured runtime log.

beacon endpoint elastic install-pack

Write Elasticsearch, Kibana, Filebeat, and Elastic Agent content to a directory.

beacon endpoint elastic up

Start a local Elasticsearch, Kibana, and Filebeat validation stack.

beacon endpoint elastic down

Stop the local Elastic validation stack.

​
Runtime log paths

​
beacon endpoint elastic print-config

beacon endpoint elastic print-config prints a Filebeat filestream config for the configured Beacon runtime JSONL log.
Print the configuration
Use this command when you want to copy the Filebeat input into an existing endpoint shipper configuration.

​
Examples

Print config for the default per-user Beacon install:
Print config for the default per-user Beacon install
Print config for a system-mode MDM deployment:
Print config for a system-mode MDM deployment
Print config for a custom runtime log:
Print config for a custom runtime log

​
Flags

​
beacon endpoint elastic install-pack

beacon endpoint elastic install-pack writes an Elastic content pack to a directory.
Generate the integration pack
The pack includes Filebeat and standalone Elastic Agent configuration, Elasticsearch ILM, component templates, an index template, an ingest pipeline, starter Kibana saved objects, a sample event, and a local Docker Compose validation stack.

​
Examples

Generate a content pack for the default per-user install:
Generate a content pack for the default per-user install
Generate a content pack for a system-mode deployment:
Generate a content pack for a system-mode deployment
Generate a content pack for a custom runtime log:
Generate a content pack for a custom runtime log

​
Flags

​
beacon endpoint elastic up

beacon endpoint elastic up starts a loopback-only local Elasticsearch, Kibana, and Filebeat stack for validating Beacon event ingestion.
Command example
The command creates the pack if it does not exist, ensures the runtime log exists, mounts the runtime log directory into Filebeat, loads Elasticsearch and Kibana assets, and starts the stack with Docker Compose. When the stack is healthy, Beacon events are searchable in the logs-beacon.endpoint-* data stream using the beacon.* fields produced by the ingest pipeline:
When the stack is healthy, Beacon events are searchable in the logs-beacon.endpoint-* data stream using the beacon.* fields produced by the ingest pipeline

​
Examples

Start the local validation stack with the default pack directory:
Start the local validation stack with the default pack directory
Start with a generated pack directory:
Start with a generated pack directory
Use alternate local ports:
Use alternate local ports

​
Flags

elastic up is a macOS local validation helper that expects Docker Desktop or Docker Compose. For production, run Filebeat or standalone Elastic Agent through your endpoint-management system instead.

​
beacon endpoint elastic down

beacon endpoint elastic down stops the local Elastic validation stack for a generated pack directory.
Command example

​
Examples

Stop the local validation stack:
Stop the local validation stack
Stop a stack that uses a custom pack directory:
Stop a stack that uses a custom pack directory

​
Flags

Elastic forwarding

Set up local, Elastic Cloud, or self-managed Elastic forwarding.

Log forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.