Skip to main content

Heartbeat

Heartbeat is an Elastic Beat for active uptime and availability monitoring (observability) that probes services over network protocols such as Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), and ICMP and ships results into the Elastic Stack for analysis and alerting.

  • Lightweight shipper (telemetry agent) for uptime and availability monitoring in the Elastic Stack
  • Performs active probing of services over HTTP, TCP, and ICMP (network monitoring)
  • Publishes collected availability and latency data to Elasticsearch or Logstash (data ingestion)
  • Integrates with Kibana Uptime app for visualization, status views, and alert configuration (observability UX)
  • Supports configuration via YAML monitors for URLs, hosts, schedules, and conditions (configuration management)

More About Heartbeat

Heartbeat is a member of the Elastic Beats family (observability data shippers) used for active uptime and availability monitoring of applications, services, and network endpoints. It runs as a lightweight agent that sends probes to configured targets over protocols such as HTTP, TCP, and ICMP, then forwards structured results to Elasticsearch or via Logstash for indexing and analysis. Within an enterprise observability architecture, Heartbeat covers the synthetic monitoring and network reachability portion of telemetry alongside metrics, logs, and traces.

The core function of Heartbeat is to execute monitors that test whether endpoints are reachable and responsive (synthetic monitoring). Monitors are defined in configuration files using YAML, specifying endpoints such as URLs, hosts, ports, and network protocols. For HTTP, Heartbeat can check response status, Transport Layer Security (TLS) settings, and response times (web and Application Programming Interface (API) monitoring). For TCP, it validates low-level connectivity and round-trip time (network connectivity). For ICMP, it performs ping-style checks to track host availability (infrastructure monitoring). Each execution records status, duration, and context fields that can be indexed and queried in Elasticsearch.

Heartbeat integrates with the wider Elastic Stack (observability platform). The agent sends data either directly to Elasticsearch or through Logstash pipelines, using Beats protocols and Elastic ingest features. Once indexed, the data is available in Kibana, where the Uptime app provides views of monitors, check histories, response times, geographical perspective if multiple locations are used, and alerting configuration based on availability or latency thresholds. This allows operations teams to treat Heartbeat as a component within a centralized monitoring and alerting workflow.

In enterprise environments, Heartbeat is typically deployed on one or more nodes that act as probing locations, such as data centers, cloud regions, or edge sites (distributed monitoring). Administrators manage Heartbeat configurations as code, defining monitors for web applications, public APIs, internal services, load balancers, and network devices. Its event format is aligned with other Beats and Elastic Common Schema patterns where applicable, which supports cross-correlation with logs, metrics, and traces from other Elastic components (integrated observability).

From a categorization perspective, Heartbeat fits into synthetic uptime monitoring, network reachability monitoring, and observability data collection. It is part of the Elastic Stack ecosystem maintained by Elastic, and is used for proactive checks that detect outages and latency issues before or alongside user-reported incidents. Because it relies on standard network protocols and Elastic ingestion paths, it interoperates with diverse infrastructure layouts and can be incorporated into CI/CD-driven or Infrastructure-as-Code (IaC) workflows that manage monitor definitions and deployment.

Mentions