# Execbeat is not outputting ps -ef|grep

**URL:** <https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177>\
**Category:** Beats\
**Created:** [February 15, 2017, 10:54am UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177 "2017-02-15T10:54:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [February 15, 2017, 10:54am UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177/1 "2017-02-15T10:54:24Z")

</div>

Hi,

I am using latest [execbeat](https://github.com/christiangalsterer/execbeat) with ELK GA 5.0.0. I would like to know if certain process is running in my PC, say, Filebeat. Running the command `ps -ef|grep filebeat` returns the output;

```
mypc 688 1 0 Jan16 ? 00:21:17 ./filebeat -c beata.yml
mypc 696 1 0 Jan16 ? 00:31:45 ./filebeat -c beatb.yml

```

I have configured execbeat like this;

```
execbeat:
  execs:
    -
      cron: "@every 5s"
      command: ps -ef|grep
      args: filebeat
      document_type: execbeat
output.console:
  enabled: true
  pretty: true

```

but, when I execute it, i am getting the output like;

```
{
  "@timestamp": "2017-02-15T10:50:24.000Z",
  "beat": {
    "hostname": "mypc",
    "name": "mypc",
    "version": "2.1.1"
  },
  "exec": {
    "command": "ps -ef|grep",
    "stdout": ""
  },
  "type": "execbeat"
}

```

Why is this happening and how can I fix this?

Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2017, 11:04am UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177/2 "2017-02-15T11:04:32Z")

</div>

What you've done won't work, and since the Execbeat's `args` option is a string that's passed as a single argument I'm not sure this can be worked around so easily except by creating a standalone script that runs the desired command. From what I can tell, running `ps aux | grep filebeat` just isn't possible with Execbeat.

If `args` had been a list of strings I would've suggested this:

```nohighlight
command: bash
args:
  - -c
  - ps aux | grep filebeat

```

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [February 15, 2017, 11:10am UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177/3 "2017-02-15T11:10:15Z")

</div>

tried

```
execbeat:
  execs:
    -
      command: bash
      args:
        - -c
        - ps aux | grep filebeat
output.console:
  enabled: true
  pretty: true

```

got

```
Exiting: Error reading config file: can not convert 'object' into 'string' accessing 'execbeat.execs.0.args' (source:'execbeattest.yml')
```

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 15, 2017, 11:13am UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177/4 "2017-02-15T11:13:53Z")

</div>

Yes. As I said that won't work but it's what I _would have_ suggested if Execbeat supported it. Create a standalone shell script and run that instead.

---

<div class="post-metadata">

**Author:** ![elasticheart](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/elasticheart/32/65189_2.png) [@elasticheart](https://discuss.elastic.co/u/elasticheart)\
**Post date:** [February 16, 2017, 12:04pm UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177/5 "2017-02-16T12:04:11Z")

</div>

I created a `.sh` script and targeted execbeat to that, it works!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:49pm UTC](https://discuss.elastic.co/t/execbeat-is-not-outputting-ps-ef-grep/75177/6 "2017-07-05T21:49:57Z")

</div>