Bizarre Error: bash: ./filebeat: No such file or directory

Elastic Stack Beats
1

So this is a surreal one... I am having issues with modules not working, and I suspect an unnamed distribution is packaging and/or installing it wrong. At my wits end I decided to manually download the precompiled binaries and give it a shot.

I downloaded from here:

https://www.elastic.co/downloads/past-releases/filebeat-7-16-3

And specifically the LINUX X86_64 item. Noting the distro installed is Alpine 3.15 x86_64:

https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.16.3-linux-x86_64.tar.gz

I then uncompressed that which creates the following directory which of course is populated with everything we expect:

/root/filebeat-7.16.3-linux-x86_64

Within that directory I edit filebeat.yml to suit my needs and then run:

./filebeat -f filebeat.yml

And I am presented with a rather surreal error:

bash: ./filebeat: No such file or directory

.... Ummmm, what?? Maybe i'm nuts so let's check:

# pwd
/root/filebeat-7.16.3-linux-x86_64

# ls -lh filebeat
-rwx------    1 root     root      119.4M Jan  7 00:42 filebeat

# /root/filebeat-7.16.3-linux-x86_64/filebeat -f /root/filebeat-7.16.3-linux-x86_64/filebeat.yml 
bash: /root/filebeat-7.16.3-linux-x86_64/filebeat: No such file or directory

# ls -lh  /root/filebeat-7.16.3-linux-x86_64/filebeat
-rwx------    1 root     root      119.4M Jan  7 00:42 /root/filebeat-7.16.3-linux-x86_64/filebeat

# ls -lh /root/filebeat-7.16.3-linux-x86_64/filebeat.yml
-rw-------    1 root     root        8.1K Feb  7 02:15 /root/filebeat-7.16.3-linux-x86_64/filebeat.yml

# file /root/filebeat-7.16.3-linux-x86_64/filebeat /root/filebeat-7.16.3-linux-x86_64/filebeat.yml
/root/filebeat-7.16.3-linux-x86_64/filebeat:     ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, Go BuildID=Kd7qKZwbIQ0ZbWeILMae/PlYgfX-Aj6ID6hwBbJMz/YR4l6CDB0evO8lr6B8Kr/qzGu4DnaT9rt2TgIKW07, BuildID[sha1]=772d3bf186367644fb63b09246b840931448c00b, stripped
/root/filebeat-7.16.3-linux-x86_64/filebeat.yml: ASCII text

So um. What is going on here? I have been doing linux stuff for well over 20 years and I haven't seen THIS before. What is going on?

2

I am not sure exactly. But filebeat does not provide a -f flag. When I download Filebeat and run the same commands you provided, I get this error:

$ ./filebeat -f filebeat.yml
Error: unknown shorthand flag: 'f' in -f
Usage:
  filebeat [flags]
  filebeat [command]

Available Commands:
  export      Export current config or index template
  generate    Generate Filebeat modules, filesets and fields.yml
  help        Help about any command
  keystore    Manage secrets keystore
  modules     Manage configured modules
  run         Run filebeat
  setup       Setup index template, dashboards and ML jobs
  test        Test config
  version     Show current version info

Flags:
  -E, --E setting=value              Configuration overwrite
  -M, --M setting=value              Module configuration overwrite
  -N, --N                            Disable actual publishing for testing
  -c, --c string                     Configuration file, relative to path.config (default "filebeat.yml")
      --cpuprofile string            Write cpu profile to file
  -d, --d string                     Enable certain debug selectors
  -e, --e                            Log to stderr and disable syslog/file output
      --environment environmentVar   set environment being ran in (default default)
  -h, --help                         help for filebeat
      --httpprof string              Start pprof http server
      --memprofile string            Write memory profile to this file
      --modules string               List of enabled modules (comma separated)
      --once                         Run filebeat only once until all harvesters reach EOF
      --path.config string           Configuration path
      --path.data string             Data path
      --path.home string             Home path
      --path.logs string             Logs path
      --plugin pluginList            Load additional plugins
      --strict.perms                 Strict permission checking on config files (default true)
      --system.hostfs string         Mount point of the host's filesystem for use in monitoring a host from within a container
  -v, --v                            Log at INFO level

Use "filebeat [command] --help" for more information about a command.

Maybe bash swallows the error message or tries to find a filebeat command that has a -f flag.

3

It appears that I was up way WAAAY too late working on this. I have no idea where I got the -f flag from, it should have been -c. Still however:

alpine-fb-test:~/filebeat-7.16.3-linux-x86_64# ./filebeat -c ./filebeat.yml 
bash: ./filebeat: No such file or directory

Lol. I suppose i'll try to compile it instead.