# Filebeat events in syslogs

**URL:** <https://discuss.elastic.co/t/filebeat-events-in-syslogs/57304>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 5, 2016, 5:26am UTC](https://discuss.elastic.co/t/filebeat-events-in-syslogs/57304 "2016-08-05T05:26:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [August 5, 2016, 5:26am UTC](https://discuss.elastic.co/t/filebeat-events-in-syslogs/57304/1 "2016-08-05T05:26:57Z")

</div>

Hi,  
We have one server in production where filebeat is running.

I just saw there are following messages in /var/log/messages  
Where is the configuration which tells such failure messages to go in syslog?

```
Aug 1 10:58:34 rssapp0 rsyslogd-2177: imuxsock lost 816 messages from pid 40716 due to rate-limiting
Aug 1 10:58:34 rssapp0 rsyslogd-2177: imuxsock begins to drop messages from pid 40716 due to rate-limiting
Aug 1 10:58:40 rssapp0 rsyslogd-2177: imuxsock lost 907 messages from pid 40716 due to rate-limiting

Aug 1 10:39:34 rssapp0 /usr/bin/filebeat[40716]: single.go:159: backoff retry: 1s
Aug 1 10:41:23 rssapp0 /usr/bin/filebeat[40716]: publish.go:104: Events sent: 2048
Aug 1 10:44:52 rssapp0 /usr/bin/filebeat[40716]: publish.go:104: Events sent: 2048
Aug 1 10:44:52 rssapp0 /usr/bin/filebeat[40716]: registrar.go:157: Registry file updated. 1 states written.
Aug 1 10:45:16 rssapp0 /usr/bin/filebeat[40716]: publish.go:104: Events sent: 2048
Aug 1 10:45:16 rssapp0 /usr/bin/filebeat[40716]: registrar.go:157: Registry file updated. 1 states written.

```

please guide on this.

Br,  
Sunil.

---

<div class="post-metadata">

**Author:** ![Sai\_Birada](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_birada/32/142367_2.png) [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\
**Post date:** [August 5, 2016, 11:23am UTC](https://discuss.elastic.co/t/filebeat-events-in-syslogs/57304/2 "2016-08-05T11:23:38Z")

</div>

Hi sunil,  
There is a logging option in filebeat config file, which you can modify. Probably you left it for default and that's why its logging to syslog, You can use following config to change it some custom file.

> ```
> logging:
> 
> ```

```
    to_syslog: false
    to_files: true
    files:
      path: /sc/log
      name: filebeat.log
      rotateeverybytes: 10485760
      keepfiles: 7
      level: debug

```

---

<div class="post-metadata">

**Author:** ![sunilmchaudhari](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sunilmchaudhari/32/9475_2.png) [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\
**Post date:** [August 5, 2016, 12:04pm UTC](https://discuss.elastic.co/t/filebeat-events-in-syslogs/57304/3 "2016-08-05T12:04:49Z")

</div>

Thanks a ton!  
That works!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 26, 2016, 5:27am UTC](https://discuss.elastic.co/t/filebeat-events-in-syslogs/57304/4 "2016-08-26T05:27:38Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.