Debian 7.9 Filebeat 6.5.4 wrong path

Elastic Stack Beats
1

Hi,
I am running Debian 7.9 and I have installed filebeat 6.5.4 with apt-get.
For some reason it starts with wrong paths:
INFO instance/beat.go:592 Home path: [/usr/share/filebeat/bin] Config path: [/usr/share/filebeat/bin] Data path: [/usr/share/filebeat/bin/data] Logs path: [/usr/share/filebeat/bin/logs]

The init.d/filebeat script seems to be setting them ok:
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="Filebeat sends log files to Logstash or directly to Elasticsearch."
NAME="filebeat"
DAEMON=/usr/share/{NAME}/bin/{NAME}
DAEMON_ARGS="-c /etc/{NAME}/{NAME}.yml -path.home /usr/share/{NAME} -path.config /etc/{NAME} -path.data /var/lib/{NAME} -path.logs /var/log/{NAME}"
TEST_ARGS="-e test config"
PIDFILE=/var/run/filebeat.pid
WRAPPER="/usr/share/{NAME}/bin/{NAME}-god"
BEAT_USER="root"
WRAPPER_ARGS="-r / -n -p $PIDFILE"
SCRIPTNAME=/etc/init.d/filebeat

Is the wrapper messing them up? Any idea how I could fix this?

2

Have you systemd installed or still SysV with init scripts?

Also check your filebeat config file. This file can also overwrite paths.

3

Thank you for the reply!
Still using SysV, and the lines above are from the init script.

In the filebeat config file I only have a config for the modules:
path: ${path.config}/modules.d/.yml
I already tried to manually set it to
path: /etc/filebeat/modules.d/.yml
with no change.

4

Hm. Can you add an echo ... before start-stop-daemon so to print the full command to be executed?

5

This is the output:
start-stop-daemon --start --pidfile /var/run/filebeat.pid --exec /usr/share/filebeat/bin/filebeat-god -- -r / -n -p /var/run/filebeat.pid -- /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml

6

Did anyone modify your init script?

See init script template: https://github.com/elastic/beats/blob/b17e12c8be44d137ec8cdaffa0a7e07b89219107/dev-tools/packaging/templates/deb/init.sh.tmpl

Original start function

do_start()
{
	# Return
	#   0 if daemon has been started
	#   1 if daemon was already running
	#   2 if daemon could not be started
	start-stop-daemon --start \
                --pidfile $PIDFILE  \
		--exec $WRAPPER -- $WRAPPER_ARGS -- $DAEMON $DAEMON_ARGS \
		|| return 2
}

$DAEMON_ARGS should include the flags setting the paths.

7

You are right, something is wrong with the DAEMON_ARGS var.
I did not modify it:
DAEMON_ARGS="-c /etc/{NAME}/{NAME}.yml -path.home /usr/share/{NAME} -path.config /etc/{NAME} -path.data /var/lib/{NAME} -path.logs /var/log/{NAME}"

For some reason it only keeps " -c /etc/filebeat/filebeat.yml "

8

This is weird. If DAEMON_ARGS is not modified, it should expand in completion. It's just a string.

Can you try to replace every occurrence of $DAEMON_ARGS with the right hand side of DAEMON_ARGS?

e.g.

do_start()
{
	# Return
	#   0 if daemon has been started
	#   1 if daemon was already running
	#   2 if daemon could not be started
	start-stop-daemon --start \
                --pidfile $PIDFILE  \
		--exec $WRAPPER -- $WRAPPER_ARGS -- $DAEMON -c /etc/${NAME}/${NAME}.yml -path.home /usr/share/${NAME} -path.config /etc/${NAME} -path.data /var/lib/${NAME} -path.logs /var/log/${NAME} \
		|| return 2
}
9

I already tried initially to replace only in do_start and it did not work.
After replacing every occurrence it started ok.

Thanks for the help!

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.