Deploy Beats filebeat to Microsoft Intune

ElasticWindowsversion 9.5.5, 6 October 2026

Beats filebeat is in the PatchBee catalog as a Windows app from Elastic, synced from the Windows Package Manager community repository (winget). Pick it in the App Library and PatchBee writes the deployment plan below, builds the package, publishes it to your Intune tenant and assigns it to the Entra groups you choose. New versions then follow through your update rings.

Deploy Beats filebeat with PatchBee How packaging works

The plan PatchBee writes

Beats filebeat as an Intune app

The standard form for a MSI (WiX) (x64, per machine). The real plan is generated from the installer when you package, and shown in full before anything is published; every field can be changed.

Intune app type: Windows app (Win32), .intunewin
Install: msiexec /i "Beatsfilebeat.msi" /qn /norestart
Uninstall: msiexec /x {84CD8645-4DB1-5D89-81E3-071FF2DC5EAE} /qn /norestart
Detection: MSI product code. Product code {84CD8645-4DB1-5D89-81E3-071FF2DC5EAE}, version 9.5.5 or newer.
Requirements: x64 · per machine

Installers in version 9.5.5

Architecture	Type	Scope	Hash
x64	MSI (WiX)	per machine	SHA-256 published

PatchBee downloads the installer from the publisher's own URL and verifies its SHA-256 against the catalog before packaging. "None published" means the source carries no hash for this download, so that check has nothing to compare against; packaging still works.

Silent install switches

Recorded for Beats filebeat in its winget manifest. PatchBee uses them as the installer's unattended switches, so the package installs without a click.

Install location: INSTALLDIR="<INSTALLPATH>"

About Beats filebeat

Filebeat is an open source file harvester, mostly used to fetch logs files and feed them into logstash. Together with the libbeat lumberjack output is a replacement for logstash-forwarder.

Publisher: Elastic
Homepage: www.elastic.co/downloads/beats/filebeat
License: Elastic-2.0
Source: winget · Elastic.Filebeat
Versions in catalog: 31

How this becomes an app in your tenant

Sign in with your Microsoft work account and connect your Intune tenant once. Find Beats filebeat in the App Library, open its plan (the commands, detection rule and requirements above, editable) and publish: PatchBee downloads and verifies the installer, builds the package, creates the Intune app and assigns your groups. When Elastic ships a new version, PatchBee detects it and rolls it out through your rings, with supersedence and rollback.

Read the step-by-step guide

More Windows apps

Beats heartbeatElastic9.5.5MSI (WiX)Beats metricbeatElastic9.5.5MSI (WiX)Beats packetbeatElastic9.5.4MSI (WiX)Beats winlogbeatElastic9.5.5MSI (WiX)Zip archive

Catalog data as of 11 October 2026, from the Windows Package Manager community repository (winget). The product re-reads the source every night and plans against the live catalog, so the version here may already be one behind. Nothing is published to a tenant without an administrator approving the plan.