After installing sudoreplay, filebeat (and likely the other beats) will fail silently when started with sudo, as in
sudo /etc/init.d/filebeat start
it will continue to run when started with the -f or --foreground flag
sudo /usr/share/filebeat/bin/filebeat-god -f -r / -n -p /var/run/filebeat.pid -- /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml
Has anyone been able to work around this issue?