Send data via Heartbeat to your Logstash instance provided by


Monitor the status of hosts at set intervals using ICMP, TCP, and HTTP.

Heartbeat is a lightweight shipping agent used to monitor the health of services running on the host. The results can then be shipped to one or more destinations, including Logstash.

Step 1 - Install Heartbeat

deb (Debian/Ubuntu/Mint)

sudo apt-get install apt-transport-https
wget -qO - | sudo apt-key add -
echo 'deb stable main' | sudo tee /etc/apt/sources.list.d/beats.list

sudo apt-get update && sudo apt-get install heartbeat

rpm (CentOS/RHEL/Fedora)

sudo rpm --import
echo "[elastic-6.x]
name=Elastic repository for 6.x packages
type=rpm-md" | sudo tee /etc/yum.repos.d/elastic-beats.repo

sudo yum install heartbeat


curl -L -O 
tar xzvf heartbeat-oss-6.7.1-darwin-x86_64.tar.gz


  • Download the Heartbeat Windows zip file from the official downloads page.

  • Extract the contents of the zip file into C:\Program Files.

  • Rename the heartbeat-<version>-windows directory to Heartbeat.

  • Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator). If you are running Windows XP, you may need to download and install PowerShell.

  • Run the following commands to install Heartbeat as a Windows service:

    PS > cd 'C:\Program Files\Heartbeat'
    PS C:\Program Files\Heartbeat> .\install-service-heartbeat.ps1`
    If script execution is disabled on your system, you need to set the execution policy for the current session to allow the script to run. For example: PowerShell.exe -ExecutionPolicy UnRestricted -File .\install-service-heartbeat.ps1.
My OS isn't here! Don't see your system? Check out the official downloads page for more options (including 32-bit versions).

Step 2 - Locate the configuration file

deb/rpm /etc/heartbeat/heartbeat.yml
mac/win <EXTRACTED_ARCHIVE>/heartbeat.yml

Step 3 - Configure the monitors

The following example shows a basic configuration for each of the three different types of monitors, ICMP, TCP, and HTTP.

- type: icmp
  schedule: '*/5 * * * * * *'
  hosts: ["myhost"]
- type: tcp
  schedule: '@every 5s'
  hosts: ["myhost:7"]  # default TCP Echo Protocol
  check.send: "Check"
  check.receive: "Check"
- type: http
  schedule: '@every 5s'
  urls: ["http://localhost:80/service/status"]
  check.response.status: 200
  limit: 10
There's also a full example configuration file called heartbeat.reference.yml that shows all the possible options.

Step 4 - Configure output

We'll be shipping to Logstash so that we have the option to run filters before the data is indexed.
Comment out the elasticsearch output block.

## Comment out elasticsearch output
#  hosts: ["localhost:9200"]

Uncomment and change the logstash output to match below.

    hosts: ["your-logstash-host:your-port"]
    loadbalance: true
    ssl.enabled: true

Step 5 - Validate configuration

Let's check the configuration file is syntactically correct.


sudo heartbeat -e -c /etc/heartbeat/heartbeat.yml


./heartbeat -e -c heartbeat.yml


heartbeat.exe -e -c heartbeat.yml

Step 6 - Start heartbeat

Ok, time to start ingesting data!


sudo systemctl enable heartbeat
sudo systemctl start heartbeat




Start-Service heartbeat
expand view

Expand View

compact view

Compact View

Return to Search
Sign Up