Beats writing logs to messages

Hi Team,
Even though I've setting for writing beat logs to file its still writing the logs to messages only. Below is the config for metricbeat i have the same for filebeat too. But both writing ton of logs to /var/logs/messages, How to avoid those ?

logging.level: info
logging.to_syslog: false
logging.to_files: true
logging.files:
  path: /opt/metricbeat/logs
  name: metricbeat
  keepfiles: 15
  permissions: 0755

Hy @Senthil_ak,

I have just tested that config and its works as expected for me.
Can you make sure that:

  • you are pointing to the right config file (use -c option)
  • there are no flags like -e at the command line that would tell the beat to write to stdout

I am running systemd process and I have file its like below

[Unit]
Description=Filebeat sends log files to Logstash or directly to Elasticsearch.
Documentation=https://www.elastic.co/products/beats/filebeat
Wants=network-online.target
After=network-online.target

[Service]

Environment="BEAT_LOG_OPTS=-e"
Environment="BEAT_CONFIG_OPTS=-c /etc/filebeat/filebeat.yml"
Environment="BEAT_PATH_OPTS=-path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /apps/filebeat/data -path.logs /apps/filebeat/logs"
ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS
Restart=always

[Install]
WantedBy=multi-user.target

Can you try commenting the line that sets the -e option?

I already tried this but still not working.

can you ps -ef | grep filebeat after starting the server and post here what you find?

Please find the output below.

root 4504 1 6 08:57 ? 00:00:00 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /apps/filebeat/data -path.logs /apps/filebeat/logs