Maintaining the Real-Time State of the Network Topology

One important feature of Packetbeat is that it knows the name of the source and destination servers for each transaction. It does this without needing to maintain a central configuration. Instead, each Beat notes the hostname of the server where the Beat runs, and maps the hostname to the list of IP addresses of that server.

Packetbeat stores the topology information in an Elasticsearch index, so to save the network topology, you need to use Elasticsearch as output and set the save_topology configuration option to true.