Ship Facter facts to Elasticsearch or Logstash.
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.
_meta Re-write with Beat Generator Feb 3, 2017
beater Set Facter invocation log to Debug level Feb 3, 2017
config Allow cross-compiling for Darwin Feb 3, 2017
docker-compose.d Bind test ES container to eth0 Feb 3, 2017
tests-acceptance Re-write with Beat Generator Feb 3, 2017
tests/system Re-write with Beat Generator Feb 3, 2017
.gitattributes Add Windows support. Jan 18, 2016
.gitignore Rewrite with Beat Generator Feb 3, 2017
.travis.yml Have Travis do a full make Feb 3, 2017 Re-write with Beat Generator Feb 3, 2017
Makefile Update README Feb 3, 2017
docker-compose.yml Fix acceptance test execution Feb 3, 2017
factbeat-test.yml Re-write with Beat Generator Feb 3, 2017
factbeat.template-es2x.json Re-write with Beat Generator Feb 3, 2017
factbeat.template.json Re-write with Beat Generator Feb 3, 2017
factbeat.yml Drop more explosive fields in example config Mar 2, 2017
main.go Re-write with Beat Generator Feb 3, 2017
version.go Set version Feb 3, 2017
version.yml Set version Feb 3, 2017


Factbeat is a Beat that ships Facter facts to Elasticsearch, where they can be stored, analyzed and compared over time.

Facter Version

Facter 3 (cFacter) is recommended, and is the default. The output from Facter 3 is more structured and more stable than that of Facter 2, which makes for a much better experience with Factbeat and Elasticsearch.

If you really want to, you can configure the path to Facter, so you could point Factbeat at Facter 2 instead.


Pre-built binaries are availble for Windows and Linux (x86_64) on the releases page.

The downloads for both platforms contain:

  • The factbeat or factbeat.exe binary
  • An example factbeat.yml config file
  • The Elasticsearch mapping template: factbeat.template.json

The Windows archive also contains two Powershell scripts, for registering and removing the Factbeat Windows service.


Build Status

Factbeat was created in accordance with the Beats Developer Guide and thus uses the common build system. With the appropriate pre-requisites in place, you should be able to simply:


to get a ./factbeat binary.

Acceptance Tests

Factbeat ships with a containerized test suite.

The containerized test system requires that you have:

  • docker
  • docker-compose
  • make

However you don't need to install Elasticsearch, Python etc. They are all packaged for you in Docker containers.

To run the suite, invoke:

make acceptance-test


  • Convert percents to beats style ie. "83.3%" -> 0.833
  • Improved mapping template.
  • Your suggestions.