Wingetlywingetly
← All apps

Beats filebeat

by Elasticv9.5.4

Last updated

Tails and ships log files

Visit homepage

Install with winget

$ winget install --id Elastic.Filebeat --exact --version 9.5.4

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Silent install command for Beats filebeat

Beats filebeat uses MSI (WiX). The silent install switches are /quiet /norestart.

One-line silent install (x64, machine scope)
msiexec.exe /i filebeat-9.5.4-windows-x86_64.msi /quiet /norestart

See the full silent install reference for Beats filebeat →

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

About

Filebeat is an open source file harvester, mostly used to fetch logs files and feed them into logstash. Together with the libbeat lumberjack output is a replacement for logstash-forwarder.

Installers · v9.5.4

ArchitectureTypeScopeInstallDownload
x64MSI
WiX
machineDirect

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

3 known CVEs via NVD

  • medium6.5Patched in wingetCVE-2026-78588affects before 8.19.18, 9.3.1Sep 2, 2026

    Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker able to reach the Filebeat HTTP ingestion endpoint could send specially crafted compressed requests that exhaust the memor...

    Vendor advisory
  • medium6.5Patched in wingetCVE-2025-68383affects before 8.19.9, 9.1.9, 9.2.3Dec 18, 2025

    Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer Overflow (CAPEC-100) and cause a denial of service (panic/crash) of the Filebeat process via either a...

    Vendor advisory
  • low3.3Patched in wingetCVE-2023-31413affects <=7.17.9May 4, 2023

    Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled.

    Vendor advisory
Source: NVD, updated 4h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr.

Related apps

  • Beats winlogbeatElastic
    Elastic.Winlogbeatv9.5.4

    Fetches and ships Windows Event logs

  • Beats packetbeatElastic
    Elastic.Packetbeatv9.5.4

    Monitors the network and applications by sniffing packets

  • Beats metricbeatElastic
    Elastic.Metricbeatv9.5.4

    Fetches sets of metrics from the operating system and services

  • ElasticsearchElastic
    Elastic.Elasticsearchv7.16.3

    Elasticsearch is a distributed, RESTful search and analytics engine

  • Beats heartbeatElastic
    Elastic.Heartbeatv9.5.4

    Ping remote services for availability

  • Beats functionbeatElastic
    Elastic.Functionbeatv8.17.3

    Ship cloud data with serverless infrastructure.

More from Elastic.

Frequently asked questions

How do I install Beats filebeat on Windows?
Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id Elastic.Filebeat --exact --version 9.5.4. winget downloads the installer from Elastic and runs it. Requires Windows 10 (1809+) or Windows 11.
How do I install Beats filebeat silently for unattended deployment?
Add --silent and accept the agreements upfront: winget install --id Elastic.Filebeat --exact 9.5.4 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.
What are the silent install switches for Beats filebeat?
Beats filebeat uses MSI (WiX). Run the downloaded installer with: msiexec.exe /i filebeat-9.5.4-windows-x86_64.msi /quiet /norestart. The silent switches are /quiet /norestart.
How do I uninstall Beats filebeat via winget?
Run: winget uninstall --id Elastic.Filebeat --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from Beats filebeat's Apps & Features entry.
Is Beats filebeat free?
Beats filebeat is distributed under Elastic-2.0. Refer to the publisher (https://www.elastic.co/downloads/beats/filebeat) for the full license terms - Wingetly itself does not charge for installation.
Does Beats filebeat work on Windows 10?
Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls Beats filebeat directly from the publisher.
How do I keep Beats filebeat up to date?
Run winget upgrade --id Elastic.Filebeat --exact, or winget upgrade --all to update everything winget tracks. We index 10 versions of Beats filebeat from microsoft/winget-pkgs.

Recent versions

  • 9.5.4latest
  • 9.5.3
  • 9.5.2
  • 9.5.1
  • 9.5.0
  • 9.4.4
  • 9.4.3
  • 9.4.2
  • 9.4.1
  • 9.4.0