Packetbeat
Packetbeat is a lightweight network data shipper (observability / network monitoring) from Elastic that captures network traffic, decodes application-layer protocols, and forwards structured metrics and traces into the Elastic Stack for analysis.
- Captures live network traffic from hosts or taps and decodes common application-layer protocols (network monitoring).
- Generates and ships transaction-level metrics and fields to Elasticsearch for indexing and analysis (observability / telemetry).
- Integrates with Kibana dashboards and Elastic Stack workflows for visualizing application and network performance (observability / analytics UI).
- Supports protocol-specific modules such as Hypertext Transfer Protocol (HTTP), Domain Name System (DNS), MySQL, PostgreSQL, Redis and others for deep visibility into request/response flows (application performance monitoring).
- Runs as a lightweight agent on servers or containers, with configuration-driven pipelines for filtering, enrichment, and output destinations (agent-based data collection).
More About Packetbeat
Packetbeat is a network data shipper (observability / network monitoring) that runs on edge hosts or network capture points to collect, decode, and transmit structured information about network traffic into the Elastic Stack. It focuses on application-layer visibility by parsing well-known protocols and turning raw packets into records suitable for indexing and querying in Elasticsearch.
At its core, Packetbeat listens to network interfaces, captures packets, and reassembles flows into transactions for supported protocols (network protocol analysis). It parses elements such as request methods, URLs, response codes, query parameters, and latency metrics, depending on the protocol. These decoded fields are then sent as events to Elasticsearch or Logstash (data ingestion), where they can be combined with logs, infrastructure metrics, and security telemetry from other Elastic agents.
The project provides protocol analyzers for services such as HTTP, DNS, MySQL, PostgreSQL, Redis and other common application protocols (application performance monitoring). This enables inspection of service behavior, request rates, response times, and error patterns without modifying application code. Packetbeat can also capture low-level metrics like network latency between services, which is useful for troubleshooting distributed systems and microservice architectures (distributed systems observability).
In enterprise environments, Packetbeat is typically deployed on application servers, database hosts, or strategically placed capture nodes (IT operations / Site Reliability Engineering (SRE)). Operations teams use it to monitor service availability, detect performance degradation, and correlate network transactions with application logs and host metrics in Kibana. Security teams can use the same data model within Elastic to observe protocol usage patterns, unusual connections, and request anomalies (network security monitoring).
Packetbeat integrates natively with Elasticsearch and Kibana as part of the Elastic Stack (observability platform). Events are indexed using predefined field mappings and can be visualized through shipped dashboards or custom visualizations. The tool relies on configuration files for defining inputs, protocol modules, processors for field enrichment or filtering, and outputs to Elasticsearch or Logstash (configuration-driven pipelines). This lets administrators control data volume, redact sensitive fields, and align events with organizational data schemas.
From a directory and taxonomy perspective, Packetbeat fits in categories such as network traffic analysis, application performance telemetry, and agent-based data collection for the Elastic Stack. It functions alongside other Beats and Elastic Agents to deliver a unified observability and security data plane across infrastructure and application layers.