primer: how bimbeats logs data
HOW YOUR DATA LIVES IN BIMBEATS
This guide explains where Bimbeats data comes from, how it’s structured, and how to explore it in Kibana.
THE FEED
Revit
Bluebeam
AutoCAD
Rhino
Adobe
Dynamo
Grasshopper
Navisworks
Workstation
ACC / BIM 360
License servers
Bimbeats agents (beats)
Elastic Cloud
dashboards & visualizations
Meet Discover
Dashboards summarize your data. Discover lets you look at the raw documents directly — the same documents this guide has been showing you, inside Kibana.
revit-event ▾
Last 7 days
action.name : “Warning” and computer.name : “STUDIO-WS07”
FIELD LIST
action.name
computer.name
warning.severity
user.name
file.name
14:02:11
Warning — Room tag outside of room
13:58:47
Warning — Highlighted elements overlap
13:41:03
Warning — Duplicate mark value
13:22:56
Warning — Elements have identical instances
This is a stylized layout, not a screenshot. The real Discover interface changes fairly often, but these four zones stay conceptually the same: the data view selector, the time range, the search bar, and a table of documents alongside a field list.
Reading a document in Discover
Click any row and it expands into the full field list — the same document card from earlier, rendered inside Kibana.
revit-event ▾
09:12:44
Open — Northgate-Pavilion-ARCH.rvt
click the row to toggle
Filtering in Discover
Three ways to narrow the document list: click a value, type a query, or scan the field list for common values.
Click to filter
Hover any field value in a document and two small buttons appear — plus to keep only matching documents, minus to exclude them.
action.name: “Warning”
+
−
computer.name: “STUDIO-WS07”
+
−
The search bar — KQL
Type directly into the search bar using KQL (Kibana Query Language). A colon means “equals”:
action.name : “Warning”
Documents where action.name is exactly “Warning”
computer.name : “STUDIO-WS07” and action.name : “Warning”
Combine conditions with and / or
warning.count > 300
Numeric comparisons work the same way on number fields
file.name : *ARCH*
Wildcards match partial values
Try it — build a query
Tap chips to add them to the query below.
BUILD: HIGH-SEVERITY WARNINGS ON ONE WORKSTATION
action.name : "Warning"
computer.name : "STUDIO-WS07"
warning.severity : "High"
action.name : “Warning” and computer.name : “STUDIO-WS07” and warning.severity : “High”
Tap all three chips above to build this query — 3 conditions combined with “and”
Field list top values
Click any field in the left sidebar and Discover shows its most common values for the current time range and filters — a fast way to see what’s actually in your data before writing a query.
Worked example
Find every warning a single workstation triggered this week.
1
Pick the data view
Open Discover and choose revit-event — warnings are recorded there.
revit-event
2
Set the time range
Set the time picker to Last 7 days. This filters on @timestamp.
revit-event
Last 7 days
3
Filter on the discriminator
Type action.name : "Warning", or find a Warning row and click the plus on action.name. This is also what makes the warning-specific fields appear.
revit-event
Last 7 days
action.name: Warning
4
Narrow to the machine
Add and computer.name : "STUDIO-WS07" to isolate one workstation.
revit-event
Last 7 days
action.name: Warning
computer.name: STUDIO-WS07
5
Read the results
Expand any row to see warning.message, warning.severity, and transaction — exactly what was happening in the model when the warning fired.
Glossary
Beat
A lightweight background collector that captures one slice of activity and queues it for upload.
Document
A single event, stored as self-contained JSON. One model open, one warning, one CPU sample.
Field
A key/value pair inside a document — the thing you actually filter, sort, or chart on.
Discriminator field
A field whose value determines which other fields the document carries, such as action.name.
Index
A bucket of similar documents. Rolls over into sequentially numbered indices as it grows.
Data view
Kibana’s lens across matching indices, presenting them as one clean searchable dataset.
Discover
The Kibana screen for exploring raw documents, as opposed to summarized dashboards.
KQL
Kibana Query Language — the syntax used in the Discover search bar, e.g. field : “value”.