# Anyone using execbeat?

**URL:** <https://discuss.elastic.co/t/anyone-using-execbeat/43071>\
**Category:** Beats\
**Created:** [March 1, 2016, 5:13am UTC](https://discuss.elastic.co/t/anyone-using-execbeat/43071 "2016-03-01T05:13:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![allenmchan](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@allenmchan](https://discuss.elastic.co/u/allenmchan)\
**Post date:** [March 1, 2016, 5:13am UTC](https://discuss.elastic.co/t/anyone-using-execbeat/43071/1 "2016-03-01T05:13:16Z")

</div>

Been testing execbeat but cannot get it to behave.

It is running  
[achan@lmc001.scl execbeat]$ ps -ef | grep -i execbeat  
root 29786 15760 0 21:03 pts/0 00:00:00 sudo ./execbeat -c /etc/execbeat/execbeat.yml  
root 29791 29786 0 21:03 pts/0 00:00:00 ./execbeat -c /etc/execbeat/execbeat.yml

but nothing is happening. No logs, nothing output to ES  
Basically i want to send the output of rpm -qa for ES to index for software auditing purposes

> execbeat:

> execs:  
> # Each - Commands to execute.  
> -  
> # Optional cron expression, defines when to execute the command.  
> # Default is every 1 minute.  
> cron: "@every 10m"

> # The command to execute by Execbeat
> 
> ```
> command: rpm
> 
> ```

> # Optional arguments to be passed to the command to execute
> 
> ```
> args: -qa
> 
> ```

---

<div class="post-metadata">

**Author:** ![allenmchan](https://avatars.discourse-cdn.com/v4/letter/a/ec9cab/32.png) [@allenmchan](https://discuss.elastic.co/u/allenmchan)\
**Post date:** [March 1, 2016, 6:07am UTC](https://discuss.elastic.co/t/anyone-using-execbeat/43071/2 "2016-03-01T06:07:44Z")

</div>

nevermind. i found the issue. The lack of logging was suspicious but ended up being the fact that i forgot to load the ES template 😊

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/anyone-using-execbeat/43071/3 "2017-07-05T21:55:15Z")

</div>