Beats writing logs to messages

Elastic Stack Beats
1

Hi Team,
Even though I've setting for writing beat logs to file its still writing the logs to messages only. Below is the config for metricbeat i have the same for filebeat too. But both writing ton of logs to /var/logs/messages, How to avoid those ?

logging.level: info
logging.to_syslog: false
logging.to_files: true
logging.files:
  path: /opt/metricbeat/logs
  name: metricbeat
  keepfiles: 15
  permissions: 0755
2

Hy @Senthil_ak,

I have just tested that config and its works as expected for me.
Can you make sure that:

  • you are pointing to the right config file (use -c option)
  • there are no flags like -e at the command line that would tell the beat to write to stdout
3

I am running systemd process and I have file its like below

[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=-path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /apps/filebeat/data -path.logs /apps/filebeat/logs"
ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target
4

Can you try commenting the line that sets the -e option?

5

I already tried this but still not working.

6

can you ps -ef | grep filebeat after starting the server and post here what you find?

7

Please find the output below.

root 4504 1 6 08:57 ? 00:00:00 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /apps/filebeat/data -path.logs /apps/filebeat/logs

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.