# FileBeat as a service. After rebooting the system it starts automatically

**URL:** <https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 14, 2020, 7:26am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075 "2020-07-14T07:26:38Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [July 14, 2020, 7:26am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/1 "2020-07-14T07:26:39Z")

</div>

Hi all,

I want to know can we run filebeat as a service. So, whenever someone rebots the system it automatically starts running again. The system in which my filebeat is running, has access to different people sometimes they reboot it, and the filebeat stops. Can we have a functionality that it automatically starts when the system is started?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 14, 2020, 7:34am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/2 "2020-07-14T07:34:17Z")

</div>

How did you install Filebeat, and what version?

---

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [July 14, 2020, 7:37am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/3 "2020-07-14T07:37:01Z")

</div>

I have installed it from [https://www.elastic.co/downloads/beats](https://www.elastic.co/downloads/beats). Currently I am having the version 7.7.1, since when I was doing the project it was the latest version and my project is live now. Some complaint came that we can not see the data for a given time/date range when I checked it, I got to know the issue that due to rebooting filebeats stopped and data is not there.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 14, 2020, 7:38am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/4 "2020-07-14T07:38:56Z")

</div>

Depending on your OS, you may need to follow the steps at the bottom of the APT/YUM section [here](https://www.elastic.co/guide/en/beats/filebeat/7.8/setup-repositories.html) to make sure that the service is auto-enabled on boot.

---

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [July 14, 2020, 7:39am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/5 "2020-07-14T07:39:59Z")

</div>

Thank you @warkolm for the quick response. I will do the same and give you the update.

---

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [July 14, 2020, 10:32am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/6 "2020-07-14T10:32:47Z")

</div>

Hi @warkolm,

I am not able to figure out how to run it in my windows command prompt. I am running the command "sudo systemctl enable filebeat" but it is not getting executed. Can you guide me a little like how can I configure in Windows OS. I tried both command prompt and powershell. But it is not executing the command. A help or steps to follow will be very much appreciated.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 14, 2020, 10:34am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/7 "2020-07-14T10:34:44Z")

</div>

Ah ok Windows is different.  
Did you follow the Windows instructions [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html)?

---

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [July 14, 2020, 10:39am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/8 "2020-07-14T10:39:25Z")

</div>

Hi,

After installing it as a service. I have to just run the command " **Start-Service filebeat**" to run it and it will run in background even after system has been restarted?

---

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [July 16, 2020, 9:20am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/9 "2020-07-16T09:20:45Z")

</div>

Hi @warkolm,

I tried the steps provided in the link. I installed it as a service in my system using PowerShell and also ran the command " **Start-Service filebeat**". But today some engineer rebooted the machine and filebeat stopped running. I was checking and saw the data were absent from today morning. What could be the issue? Can you please guide me

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 16, 2020, 10:40pm UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/10 "2020-07-16T22:40:51Z")

</div>

Not sure sorry, hopefully someone else will be able to assist.

---

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [August 4, 2020, 11:44am UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/11 "2020-08-04T11:44:54Z")

</div>

hi @TUSHAR_Sinha, how did you install the service? Did you use our windows msi or the ran the install script inside the zip?  
Can you check what is the startup type, you can run:

`GET-Service filebeat | select -property name,starttype`

In the example I use `filebeat`, you should use the service name.

is it `Manual` ? That could be your issue

---

<div class="post-metadata">

**Author:** ![TUSHAR\_Sinha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tushar_sinha/32/69782_2.png) [@TUSHAR\_Sinha](https://discuss.elastic.co/u/TUSHAR_Sinha)\
**Post date:** [August 18, 2020, 5:06pm UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/12 "2020-08-18T17:06:35Z")

</div>

Hi @MarianaD,  
I have downloaded the filebeat from the official website then, I run the command in my powershell prompt to install the filebeat as a service.  
The command was: .\install-service-filebeat.ps1  
Then I run Start-Service filebeat

But it is being stopped if I reboot my system. Can you tell me any alternative to do it. Or is this the wrong way to do for windows?

---

<div class="post-metadata">

**Author:** ![MarianaD](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marianad/32/42687_2.png) [@MarianaD](https://discuss.elastic.co/u/MarianaD)\
**Post date:** [September 7, 2020, 3:04pm UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/13 "2020-09-07T15:04:00Z")

</div>

hi @TUSHAR_Sinha, sorry for the late reply, in the install file the service's startup type should be automatic (delayed) so it should restart each time.  
I was interested above in the startup type of the service, can you run  
`GET-Service filebeat | select -property name,starttype`  
and let me know what is the result?  
I wonder if tries starting but it's being stopped, can you check the logs and let us know if you see anything suspicious (was filebeat starting but had to stop?, any exceptions)?  
Also, I mentioned the msi above, did you give that one a try instead, it would be interesting to see if the behavior changed if it has been installed through the msi.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 5, 2020, 5:04pm UTC](https://discuss.elastic.co/t/filebeat-as-a-service-after-rebooting-the-system-it-starts-automatically/241075/14 "2020-10-05T17:04:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
