Modernize Node.js + Filebeat ingestion guide for Elastic Stack 9.0

[alexandra5000]

This PR updates the “Ingest logs from a Node.js web application using Filebeat” tutorial to align with Elastic Stack 9.0 GA .

Summary of changes:

• Replaced the deprecated log input with filestream.

• Updated instructions for locating the Cloud ID using the Elastic Cloud console (replacing the outdated Kibana path).

• Removed obsolete setup steps for creating deployments and connected securely sections; replaced with current "Before you begin" guidance and links to centralized Cloud setup docs.

• Added ::::{stepper} blocks for procedural steps.

Closes #1968

[github-actions]

🔍 Preview links for changed docs

• manage-data/ingest/ingesting-data-from-applications/ingest-logs-from-nodejs-web-application-using-filebeat.md

[alexandra5000]

@pierrehilbert Hi Pierre, this page contains information that is outdated in version 9.0, and we need to update it. Could you please refer me to someone from your team who can review it?

[pierrehilbert]

@belimawr could you please review here?

[belimawr]

Folks, I ended up reviewing more than just the changes. I took the time to actually follow the whole tutorial, so my comments are a mix of suggestions on the changes made and the overall structure of this tutorial.

[belimawr]

The GH suggestion might not work very well. I believe this example should be updated, following the tutorial today we get logs like this:

{"@timestamp":"2025-10-14T16:11:36.402Z","client":{"address":"::1","ip":"::1","port":42836},"ecs.version":"8.10.0","http":{"request":{"body":{"bytes":0},"headers":{"accept-encoding":"gzip, deflate, br","connection":"keep-alive","content-length":"0","from":"emu@zoo","host":"localhost:3000","user-agent":"got (https://github.com/sindresorhus/got)"},"method":"PUT"},"response":{"headers":{"foo":"Bar"},"status_code":200},"version":"1.1"},"log.level":"info","message":"handled request","url":{"full":"http://localhost:3000/","path":"/"},"user_agent":{"original":"got (https://github.com/sindresorhus/got)"}}

One key difference is that the ECS version in the logs is now 8.10.0.

Suggested change

	```json
	{"@timestamp":"2021-09-09T18:42:20.799Z","log.level":"info","message":"handled request","ecs":{"version":"1.6.0"},"http":{"version":"1.1","request":{"method":"POST","headers":{"user-agent":"got (https://github.com/sindresorhus/got)","from":"octopus@the.zoo","accept":"application/json","accept-encoding":"gzip, deflate, br","host":"localhost:3000","connection":"close","content-length":"0"},"body":{"bytes":0}},"response":{"status_code":200,"headers":{"foo":"Bar"}}},"url":{"path":"/","full":"http://localhost:3000/"},"client":{"address":"::ffff:127.0.0.1","ip":"::ffff:127.0.0.1","port":49930},"user_agent":{"original":"got (https://github.com/sindresorhus/got)"}}
	```
	```json
	{"@timestamp":"2025-10-14T16:11:36.402Z","client":{"address":"::1","ip":"::1","port":42836},"ecs.version":"8.10.0","http":{"request":{"body":{"bytes":0},"headers":{"accept-encoding":"gzip, deflate, br","connection":"keep-alive","content-length":"0","from":"emu@zoo","host":"localhost:3000","user-agent":"got (https://github.com/sindresorhus/got)"},"method":"PUT"},"response":{"headers":{"foo":"Bar"},"status_code":200},"version":"1.1"},"log.level":"info","message":"handled request","url":{"full":"http://localhost:3000/","path":"/"},"user_agent":{"original":"got (https://github.com/sindresorhus/got)"}}

[alexandra5000]

Thanks for catching that!

[belimawr]

This whole section is not aligned with the new solutions default view.

I suggest just linking to another docs (maybe from Kibana) that show how to create data visualisations, this way we don't have to keep updating Filebeat docs every time Kibana changes the navigation.

[alexandra5000]

Makes sense, I removed the steps and added a link instead.

[belimawr]

In 9.1.4 the API also returns the encoded field:

{
  "id": "yC9C5JkBk-xuk5nSlGlK",
  "name": "filebeat-api-key",
  "api_key": "hGDpbhHEeAUbvNaQlStNlg",
  "encoded": "eUM5QzVKa0JrLXh1azVuU2xHbEs6aEdEcGJoSEVlQVVidk5hUWxTdE5sZw=="
}

I'm not sure when this was introduced, probably it's ok if we omit it here, but if we want to show the current APIs, then we should also add it.

[belimawr]

I found a request that works well:

POST /_security/api_key
{
 "name": "filebeat-api-key",
 "role_descriptors": {
   "filebeat_role": {
     "cluster": ["manage_index_templates", "monitor", "read_ilm"],
     "index": [
       {
         "names": ["filebeat-*"],
         "privileges": ["create_index", "write", "read", "manage"]
       }
     ]
   }
 }
}

There are two key changes:

• Added the cluster privilege read_ilm
• Renamed the role to filebeat_role

[alexandra5000]

Thank you, updated!

[alexandra5000]

@belimawr Thank you for your comments! 🫶 I've updated the file, please take a look and let me know if it looks fine now.