Metricbeat is made up of two components: one is called modules and the other is called metricsets. A Metricbeat module defines the basic logic of collecting data from a specific service, such as MongoDB, Apache, and so on. The module specifies details about the service, including how to connect, how often to collect metrics, and which metrics to collect.

Each module has one or more metricsets. A metricset is the component that collects a list of related metrics from services or the operating system using a single request. It structures event data and ships it to the configured outputs, such as Elasticsearch or Logstash. 

Metricbeat collects metrics periodically, based on the interval specified in the metricbeat.yml configuration file, and publishes the event to the configured output asynchronously. Since the events are published asynchronously, just like in Filebeat, which guarantees delivery at least once, if the configured output is not available, the events will be lost. 

For example, the MongoDB module provides the status and dbstats metricsets, which collect information and statistics by parsing the returned response obtained from running the db.serverStatus() and db.stats() commands on MongoDB, as shown in the following diagram:

The key benefits of Metricbeat are as follows: 

• Metricbeat sends error events, too: When the service is not reachable or is down, Metricbeat will still send events that contain full error messages obtained when they are fetching information  from the host systems. This is beneficial for troubleshooting or identifying the reason behind the outage of the service. 
• Combines multiple related metrics into a single event: Metricbeat fetches all related metrics from the host system, making a single request rather than making multiple requests for fetching each metric one by one, thus resulting in less load on the services/host systems. Fetched metrics are combined into a single event and sent to the configured output.
• Sends metadata information: Metrics sent by Metricbeat contain both numbers as well as strings for contacting the status information. It also ships basic metadata information about each metric as part of each event. This is helpful for mapping appropriate data types during storage and helps with querying/filtering data, identifying events based on metadata information, and so on.
• Sends raw data as it is: Metricbeat sends obtained raw data as-is without performing any processing or any aggregation operations on it, thus reducing its complexity.