# Filebeat 7.10.1 cannot write to /var/log/filebeat

**URL:** <https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 27, 2021, 9:08pm UTC](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419 "2021-01-27T21:08:13Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![matG](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@matG](https://discuss.elastic.co/u/matG)\
**Post date:** [January 27, 2021, 9:08pm UTC](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419/1 "2021-01-27T21:08:13Z")

</div>

Hi 🙂

I am currently having an issue with filebeat. It is running and can connect to the kafka host although it is not creating /var/log/filebeat nor writing to it. Which I believe is key to then send the beats over to kafka.  
I followed [https://www.elastic.co/guide/en/beats/filebeat/7.x/running-with-systemd.html](https://www.elastic.co/guide/en/beats/filebeat/7.x/running-with-systemd.html)  
But still no luck

```auto
    sudo systemctl edit filebeat.service
    [Service]
    Environment=“BEAT_LOG_OPTS=”
    [centos@hostA ~]$ sudo systemctl edit filebeat.service
    [centos@hostA ~]$ sudo systemctl daemon-reload
    [centos@hostA ~]$ sudo systemctl restart filebeat
    No folder created in /var/log

```

My playbook:

```auto
    ---
    - name: Install or update filebeat client
      hosts: hostA
      gather_facts: yes
      tasks:
        - name: Retrieve latest beats role
          shell: ansible-galaxy install --force -p /elastic-log/ elastic.beats
          delegate_to: 127.0.0.1
          no_log: false #turn to true after debug
        - name: Install filebeat
          no_log: false #turn to true after debug
          include_role:
            name: elastic.beats
          vars:
            beat: filebeat
            beat_conf:
              filebeat:
                inputs:
                - type: log
                  enabled: true
                  paths: ['/tmp/hostA/logs/*.log']
                  scan_frequency: 5s
                  ignore_older: 5h

                  fields:
                    topic: hostA_logs
                  fields_under_root: true

              logging:
                files:
                  keepfiles: 10
                  name: filebeat.log
                  path: '/var/log/filebeat/'
                  rotateeverybytes: 10485760
                  permissions: 0644
                level: debug
                to_files: true

              output.kafka:
                enabled: true
                hosts: ["hostB"]
                topic: '%{[topic]}'
                partition.round_robin:
                  reachable_only: false
                required_acks: 1

              output.elasticsearch:
                enabled: false

```

---

<div class="post-metadata">

**Author:** ![matG](https://avatars.discourse-cdn.com/v4/letter/m/ecc23a/32.png) [@matG](https://discuss.elastic.co/u/matG)\
**Post date:** [January 28, 2021, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419/2 "2021-01-28T15:12:34Z")

</div>

Fixed!  
I was following this example [https://www.elastic.co/guide/en/beats/filebeat/current/running-with-systemd.html](https://www.elastic.co/guide/en/beats/filebeat/current/running-with-systemd.html)

Which points to edit filebeat.service from /etc/systemd/system/filebeat.service.d/debug.conf

My filebeat.service was actually in /usr/lib/systemd/system

I removed the --env from it and logs are now written in /var/log/filebeat 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 25, 2021, 5:12pm UTC](https://discuss.elastic.co/t/filebeat-7-10-1-cannot-write-to-var-log-filebeat/262419/3 "2021-02-25T17:12:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.