Data flow

Before we get started with data collection, it would be good to have a basic visualization to highlight the data flow for the Elastic Endpoint Agent, Beats, Elasticsearch, Kibana, and Fleet.

In the following diagram, you can see these flows:

• The Elastic Endpoint Agent sends logs to Elasticsearch.
• The Beats (we're using Winlogbeat and Packetbeat, but all Beats do this by default) send their logs to Elasticsearch.
• Elasticsearch data is rendered by Kibana.
• Kibana uses Fleet to send command-and-control instructions to the Elastic Endpoint Agent:



Figure 6.1 – Example of log and Fleet data flow

In this section, we had a high-level exploration of the data flow that we'll use throughout this chapter and the rest of the book.

In the next section, we'll begin configuring our Beats, Winlogbeat and Packetbeat.