FileBeat as a service. After rebooting the system it starts automatically

Elastic Stack Beats
#1

Hi all,

I want to know can we run filebeat as a service. So, whenever someone rebots the system it automatically starts running again. The system in which my filebeat is running, has access to different people sometimes they reboot it, and the filebeat stops. Can we have a functionality that it automatically starts when the system is started?

#2

How did you install Filebeat, and what version?

#3

I have installed it from https://www.elastic.co/downloads/beats. Currently I am having the version 7.7.1, since when I was doing the project it was the latest version and my project is live now. Some complaint came that we can not see the data for a given time/date range when I checked it, I got to know the issue that due to rebooting filebeats stopped and data is not there.

#4

Depending on your OS, you may need to follow the steps at the bottom of the APT/YUM section here to make sure that the service is auto-enabled on boot.

#5

Thank you @warkolm for the quick response. I will do the same and give you the update.

#6

Hi @warkolm,

I am not able to figure out how to run it in my windows command prompt. I am running the command "sudo systemctl enable filebeat" but it is not getting executed. Can you guide me a little like how can I configure in Windows OS. I tried both command prompt and powershell. But it is not executing the command. A help or steps to follow will be very much appreciated.

#7

Ah ok Windows is different.
Did you follow the Windows instructions here?

#8

Hi,

After installing it as a service. I have to just run the command "Start-Service filebeat" to run it and it will run in background even after system has been restarted?

#9

Hi @warkolm,

I tried the steps provided in the link. I installed it as a service in my system using PowerShell and also ran the command "Start-Service filebeat". But today some engineer rebooted the machine and filebeat stopped running. I was checking and saw the data were absent from today morning. What could be the issue? Can you please guide me

#10

Not sure sorry, hopefully someone else will be able to assist.

#11

hi @TUSHAR_Sinha, how did you install the service? Did you use our windows msi or the ran the install script inside the zip?
Can you check what is the startup type, you can run:

GET-Service filebeat | select -property name,starttype

In the example I use filebeat, you should use the service name.

is it Manual ? That could be your issue

#12

Hi @MarianaD,
I have downloaded the filebeat from the official website then, I run the command in my powershell prompt to install the filebeat as a service.
The command was: .\install-service-filebeat.ps1
Then I run Start-Service filebeat

But it is being stopped if I reboot my system. Can you tell me any alternative to do it. Or is this the wrong way to do for windows?

#13

hi @TUSHAR_Sinha, sorry for the late reply, in the install file the service's startup type should be automatic (delayed) so it should restart each time.
I was interested above in the startup type of the service, can you run
GET-Service filebeat | select -property name,starttype
and let me know what is the result?
I wonder if tries starting but it's being stopped, can you check the logs and let us know if you see anything suspicious (was filebeat starting but had to stop?, any exceptions)?
Also, I mentioned the msi above, did you give that one a try instead, it would be interesting to see if the behavior changed if it has been installed through the msi.