primer: how bimbeats logs data
HOW YOUR DATA LIVES IN BIMBEATS
This guide explains where Bimbeats data comes from, how it’s structured, and how to explore it in Kibana.
THE FEED
Revit
Bluebeam
AutoCAD
Rhino
Adobe
Dynamo
Grasshopper
Navisworks
Workstation
ACC / BIM 360
License servers
Bimbeats agents (beats)
Elastic Cloud
dashboards & visualizations
Collection & Flow
Local agents on workstations, server-side integrations for cloud services, and a data pipeline that lands everything in one Elasticseach database.
1
Local ingestion & buffering
Collection agents run on end-user workstations. As events are captured, they're written locally as JSON payloads to a dedicated folder in ProgramData.
2
The Uploader service
Rather than streaming every event over the network as it happens, a local background service scans that folder and bulk-uploads the queued payloads once a minute.
3
Elasticsearch storage
Structured data is securely stored, indexed, and made searchable in Elasticsearch, hosted in Elastic Cloud. From there it's available to Kibana, alerting rules, and reporting, and LLM integration.
Desktop collectors — the “beats”
Lightweight background processes, services, and application plugins run silently and capture real-time, detailed workflow telemetry—including specific design software commands, active window titles, hardware resource utilization, file information, and more.
Revit plugin
Revit Event & Revit Log
A dedicated plugin talks directly to the Revit API, capturing deep model context tied to users and projects. Sync times, warning counts, linked files, content management, pop-ups, crashes, etc.
Filebeat
Log & journal tracking
Tails active text logs, CSVs, and JSON files as they're written. Most notably it watches the Revit journal, which records every command usage in real time.
Metricbeat
Hardware performance
Monitors system resources: drive space, RAM and CPU utilization, per-process consumption (like Revit.exe), and machine uptime.
Winlogbeat
Windows event viewer
Pulls events from the Windows Event Viewer such as log-on success and failure, and hangs.
BimbeatsApps
Active window & versions
Checks which application is topmost at a set interval, recording process, version, window title, user, and machine. Also handles folder-size tracking and application version reporting.
Server-side collectors
Run centrally on your organization’s Windows Server. These centralized agents gather operational, cloud-based, and network-licensing data.
The primary server-side collectors are structured as follows:
Cloud integration
Autodesk Construction Cloud / BIM 360
Uses Autodesk Platform Services APIs. Registered as a secure custom integration in your hub, it polls on a schedule to track cloud model activity, file versioning, and publishing metadata.
License servers
Concurrent license tracking
Filebeat can be deployed on license servers to tail usage logs, reporting active checkouts so you can right-size seat counts and avoid overage fees.
How the data is structured
Elasticsearch is a NoSQL (non-relational) database. Instead of rigid tables with fixed columns, it stores self-contained JSON documents.
NoSQL (meaning "not only SQL") is a non-relational database design that stores data in flexible formats instead of rigid tables. It scales horizontally to handle large amounts of unstructured data.
There are four key elements to understand data structure for Bimbeats:
Fields live inside documents.
Documents live inside indices.
Indices are organized into data views.
fields
documents
indices
data views
data view
index-000001
document
• field
• field
• field
• field
• field
• field
document
• field
• field
• field
• • •
index-000002
document
• field
• field
• field
• field
• field
document
• field
• field
• field
• • •
• • •
Fields: the pieces of information
Key/value pairs holding a specific piece of metadata about the event logged. These are the values you’ll sort, filter, and calculate on when you build dashboards.
Here’s a collection of fields from a document collected in revit-event when a Revit file opened:
@timestamp
date
2026-03-04T09:12:44Z
When the activity was recorded, in UTC.
user.name
keyword
ebennett
The person logged into the computer.
computer.name
keyword
CPU-WS07
The active workstation.
file.name
keyword
Sobon-Plaza-ARCH
The Revit model being worked on.
action.name
KEYWORD
Open
The name of the action taken.
action.duration
number
184.2
How long the action took, in seconds.
file.size(mb)
number
412.6
Model size at the moment of capture.
warning.count
number
318
The total warning count.
Documents: the individual events
In a spreadsheet you have rows. In Bimbeats, you have documents. Every action captured creates one standalone document.
Documents are extremely flexible. A Revit warning and a CPU sample can sit in the same system without either having to conform to the other’s structure. Below are document samples from different sources and events.
revit-event
action.name: “Open”
Fires when a user opens a Revit model. Carries a full snapshot of model health at that moment.
user.name
cbingley
file.name
Northgate-Pavilion-ARCH.rvt
action.duration
184.2
file.size(mb)
412.6
warning.count
318
project.instances.count
7,428
revit-event
action.name: “View”
Recorded when the user switches the view. Describes what the view contains.
user.name
cbingley
view.name
L02 — Overall Plan
sheet.name
L02 Floor Plan
view.opening.duration
6.8 s
view.instances.count
7,204
view.imports.count
2
view.hastemplate
false
revit-log
action.name: “TaskDialog”
Fires when Revit shows the user a dialog box. Captures what the user saw on screen.
user.name
fdarcy
computer.name
STUDIO-WS12
file.name
Northgate-Pavilion-ARCH.rvt
dialog.id
TaskDialog_Serious_Error_Occurred
message
Revit encountered a serious error...
software.version
2025.3.0
log
action.name: “ActiveWindow”
Published at a set interval, recording the topmost application on screen at that moment.
user.name
wcollins
process
Bluebeam.exe
title
Plan Markup - Bluebeam Revu x64
action.duration
60 s
computer.name
STUDIO-WS12
log
action.name: “Process Version”
Reports the installed version of select applications so you can audit consistency across machines.
name
desktopconnector.applications.tray
version
2027.1.0.59
user.name
wcollins
computer.name
STUDIO-WS03
metricbeat
metricset.name: “process”
Sampled on a schedule, capturing how much CPU and memory a single process is consuming right then.
host.name
STUDIO-WS07
process.name
Revit.exe
system.process.cpu.total.norm.pct
0.87
system.process.memory.rss.pct
0.41
metricset.period
60000
Not every document has every field
Because this is a NoSQL store, different kinds of events can live together without a shared structure.
A discriminator is a field whose value determines which other fields will be present in the document. See examples for revit-event below.
“Open”
“Warning”
“Synch”
“Family”
FIRES WHEN A USER OPENS A REVIT FILE
Opening a model
Captures a full snapshot of model health at the moment of opening, plus how long the open event took.
revit-event
action.name: “Open”
file.size(mb)
412.6
action.duration
184.2
warning.count
318
file.type
Local
parameters.Project Number
24-0117
Indices: the storage buckets
An index is a collection of similar documents. Bimbeats organizes your data into separate buckets based on its source.
beat-revit-event-*
Revit model health and event metadata: opens, saves, syncs, warnings, views, sheets, families.
Open · Saved · Synch · Warning · View
beat-revit-log-*
Journal-level Revit events: crashes, dialogs, prints, transactions, imports and exports.
TaskDialog · Failure · File Imported
beat-revit-user-*
Revit journal interactions: ribbon clicks, keyboard shortcuts, command sources.
RibbonEvent · Command · Data
beat-log-*
General application logs: active window states, software and add-in versions, folder sizes, user location.
ActiveWindow · Process Version · Directory
beat-metricbeat-*
System performance and hardware: CPU, RAM, disk, uptime, per-process resource usage.
process · cpu · memory · filesystem
beat-bluebeam-*
Bluebeam actions: markup activity, tool commands, Studio session usage.
Add Markup · Measure.Tool · Sign Document
Naming and rollover
beat-metricbeat-8.3.3-000012
Index names follow a consistent pattern: the collector that produced the data, the version of that collector, and a sequential rollover number. Once it reaches a size or age threshold it automatically rolls over, and 000012 becomes 000013. Both are still fully searchable; you just now have two physical indices holding one logical stream of data. Data views tie them together.
Data views: your lens into Kibana
Because a single stream of data is split across multiple sequentially numbered indices, Kibana uses data views to group them together and present them as one clean, searchable dataset.
beat-revit-event-1.0.0-000002
beat-revit-event-1.0.0-000003
beat-revit-event-1.0.0-000004
revit-event
data view
Discover & dashboards
what you actually use
revit-event
beat-revit-event-*
Model health: file size, warnings, worksets, views, sheets, families, syncs
revit-log
beat-revit-log-*
Crashes, dialogs, prints, imports and exports, transactions
log
beat-log-*
Time in applications, active window, software versions, folder sizes
metricbeat
beat-metricbeat-*
CPU, RAM, disk, machine uptime, per-process usage
bluebeam
beat-bluebeam-*
Bluebeam actions, markup activity, Studio usage
revit-user
beat-revit-user-*
Ribbon vs. keyboard shortcut usage, journal-level interactions
As an end user, you don’t have to know or care which raw index your data lives in. You point Discover and your dashboards at revit-event or metricbeat data views, and Kibana translates the raw database indices into a clean list of searchable, visualizable fields.
Glossary
Beat
A lightweight background collector that captures one slice of activity and queues it for upload.
Document
A single event, stored as self-contained JSON. One model open, one warning, one CPU sample.
Field
A key/value pair inside a document — the thing you actually filter, sort, or chart on.
Discriminator field
A field whose value determines which other fields the document carries, such as action.name.
Index
A bucket of similar documents. Rolls over into sequentially numbered indices as it grows.
Data view
Kibana’s lens across matching indices, presenting them as one clean searchable dataset.
Discover
The Kibana screen for exploring raw documents, as opposed to summarized dashboards.
KQL
Kibana Query Language — the syntax used in the Discover search bar, e.g. field : “value”.