---
title: 'Beats: Packetbeat'
description: Send Packetbeat network traffic logs to Coralogix through your own Logstash instance and parse them in Coralogix.
url: https://coralogix.com/docs/integrations/security/beats-packetbeat/
product: snowbit
feature: Snowbit Overview
feature_id: snowbit-general
feature_identifier: snowbit/snowbit-general
last_updated: '2026-10-29'
---

# Beats: Packetbeat

Coralogix integrates with `Packetbeat` so you can send your network usage logs from anywhere and parse them according to your needs.

## What you need

* Have `Packetbeat` installed. For more information on how to install it, see [the Elastic documentation](https://www.elastic.co/guide/en/beats/packetbeat/current/packetbeat-installation.html).

* A [Logstash](https://coralogix.com/docs/integrations/files/logstash.md) instance that you run in your own infrastructure, configured to receive Beats input and forward it to Coralogix. Coralogix no longer hosts a Logstash server for Beats shippers. See [Run your own Logstash instance](https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash.md#run-your-own-logstash-instance) for the Logstash input, filter, and output configuration.

## General

**Private Key**: Your [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md) is a unique ID that represents your company.

**Company Id**: A unique number that represents your company. You can get your company id from the settings tab in the Coralogix dashboard.

**Application Name**: The name of your main application, for example, a company named "SuperData" would probably insert the "SuperData" string parameter or if they want to debug their test environment they might insert the "SuperData - Test".

**SubSystem Name**: Your application probably has multiple subsystems, for example: Backend servers, Middleware, Frontend servers etc. in order to help you examine the data you need, inserting the subsystem parameter is vital.

## [](https://github.com/coralogix/integrations-docs/blob/master/integrations/packetbeat/README.rst#configuration)Configuration

Open your `Packetbeat` configuration file and configure it to use `Logstash`. For more information about configuring `Packetbeat` to use `Logstash`, see [the Elastic documentation](https://www.elastic.co/guide/en/beats/packetbeat/current/config-packetbeat-logstash.html).

Point your `Packetbeat` to output to your own Logstash instance:

```
<logstash-ip-address>:5044
```

Note

The Coralogix-hosted Logstash endpoints (`logstashserver.coralogix.com`, `logstash.coralogix.in`, `logstashserver.coralogix.us`) are retired and no longer accept data. See [Deprecation of Coralogix-hosted Logstash](https://coralogix.com/docs/user-guides/latest-updates/deprecations/logstash.md).

Set the [General](#general) values (Send-Your-Data API key, application name, and subsystem name) in your Logstash configuration, not in `packetbeat.yml`.

Here is a basic example of `packetbeat.yml` for watching HTTP packages:

```
#========================== Network targets to watch ===========================



packetbeat.interfaces.device: any

packetbeat.protocols:

- type: http

  ports: [80, 8080, 8000, 5000, 8002]

  hide_keywords: ["pass", "password", "passwd"]

  send_headers: ["User-Agent", "Cookie", "Set-Cookie"]

  split_cookie: true

  real_ip_header: "X-Forwarded-For"



#----------------------------- Logstash output --------------------------------



output.logstash:

  enabled: true

  hosts: ["<logstash-ip-address>:5044"]
```