---
title: Beats for Elasticsearch Serverless
description: Beats are lightweight data shippers that send operational data to Elasticsearch. Elastic provides separate Beats for different types of data, such as...
url: https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/serverless/beats
products:
  - Beats
  - Elastic Cloud Serverless
applies_to:
  - Elastic Cloud Serverless: Generally available
  - Elastic Stack: Generally available
---

# Beats for Elasticsearch Serverless
Beats are lightweight data shippers that send operational data to Elasticsearch. Elastic provides separate Beats for different types of data, such as logs, metrics, and uptime. Depending on what data you want to collect, you might need to install multiple shippers on a single host.
Beats are not hosted by Elastic. You deploy and manage them on your own infrastructure, such as on-premises servers, virtual machines, or containers. Beats work with all Elasticsearch Serverless project types, including Elasticsearch, Observability, and Security projects.
<tip>
  If you're looking for a hosted data collection option that doesn't require managing infrastructure, consider [agentless integrations](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/solutions/manage-data/ingest/agentless/agentless-integrations), which run on Elastic's infrastructure and require no agent deployment or maintenance.
</tip>


| Data                   | Beats                                                                                          |
|------------------------|------------------------------------------------------------------------------------------------|
| Audit data             | [Auditbeat](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/auditbeat)   |
| Log files and journals | [Filebeat](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/filebeat)     |
| Availability           | [Heartbeat](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/heartbeat)   |
| Metrics                | [Metricbeat](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/metricbeat) |
| Network traffic        | [Packetbeat](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/packetbeat) |
| Windows event logs     | [Winlogbeat](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/winlogbeat) |

Beats can send data to Elasticsearch directly or through Logstash, where you can further process and enhance the data before visualizing it in Kibana.

## Set up Beats with Elasticsearch Serverless

To send data to an Elasticsearch Serverless project, configure your Beat to connect using the project's Elasticsearch endpoint URL and an API key.

### Get your connection details

1. Log in to [Elastic Cloud](https://cloud.elastic.co/).
2. Find your **Elasticsearch endpoint URL**. Select **Manage** next to your project, then find the Elasticsearch endpoint under **Application endpoints, cluster and component IDs**. Alternatively, open your project, select the help icon, then select **Connection details**.
3. Create an **API key** with the appropriate privileges. Refer to [Create API key](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/solutions/elasticsearch-solution-project/search-connection-details#create-an-api-key-serverless) for detailed steps. For information on the required privileges, refer to [Grant access using API keys](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/filebeat/beats-api-keys).


### Configure the output

In your Beat configuration file (for example, `filebeat.yml`), set the `output.elasticsearch` section with your endpoint URL and API key:
```yaml
output.elasticsearch:
  hosts: ["ELASTICSEARCH_ENDPOINT_URL"]
  api_key: "YOUR_API_KEY"
```

<note>
  Do not use `cloud.id` or `cloud.auth` for Elasticsearch Serverless projects. Those settings are for [Elastic Cloud Hosted](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/filebeat/configure-cloud-id) deployments only.
</note>


### Install and start your Beat

Follow the quick start guide for the Beat you want to use:
- [Auditbeat quick start](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/auditbeat/auditbeat-installation-configuration)
- [Filebeat quick start](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/filebeat/filebeat-installation-configuration)
- [Heartbeat quick start](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/heartbeat/heartbeat-installation-configuration)
- [Metricbeat quick start](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/metricbeat/metricbeat-installation-configuration)
- [Packetbeat quick start](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/packetbeat/packetbeat-installation-configuration)
- [Winlogbeat quick start](https://www.elastic.co/elastic/docs-builder/docs/3028/reference/beats/winlogbeat/winlogbeat-installation-configuration)

When you reach the connection setup step, use the Elasticsearch Serverless configuration from [Configure the output](#serverless-configure-output) instead of the `cloud.id` or `hosts` examples shown for other deployment types.

## Differences from other deployment types

When using Beats with Elasticsearch Serverless, keep the following differences in mind:
- **Authentication**: Elasticsearch Serverless requires API key authentication. Username and password authentication, `cloud.id`, and `cloud.auth` are not supported.
- **Data stream lifecycle**: Elasticsearch Serverless uses data stream lifecycle (DSL) instead of index lifecycle management (ILM). ILM settings in your Beat configuration are ignored. Refer to the [data stream lifecycle](https://docs-v3-preview.elastic.dev/elastic/docs-builder/docs/3028/manage-data/lifecycle/data-stream) documentation for details.
- **Ingest pipelines**: Ingest pipelines work the same way as in other deployment types.