# Filebeat god restart
**URL:** https://discuss.elastic.co/t/filebeat-god-restart/281723
**Category:** Beats
**Tags:** filebeat
**Created:** [August 17, 2021, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723 "2021-08-17T16:10:42Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)
#### Post date: [August 17, 2021, 4:10pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/1 "2021-08-17T16:10:42Z")
I want to restart an old Filebeat service after modifying its output.
This is the result of `ps -eaf | grep filebeat`:
```auto
root 6405 1 0 2020 ? 00:00:00 /usr/share/filebeat/bin/filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
root 6406 6405 0 2020 ? 11:35:43 /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
```
Does this mean there are 2 instances of Filebeat running? Or is the second process a child of the first one? How can I restart Filebeat in this case?
---
### Author:  [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)
#### Post date: [August 18, 2021, 6:39pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/2 "2021-08-18T18:39:48Z")
Should I simply rerun the first cmd ... `...filebeat-god...` ?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 18, 2021, 8:59pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/3 "2021-08-18T20:59:17Z")
How did you start it originally?
Perhaps with systemctl
See here
> **[Filebeat and systemd | Filebeat Reference \[7.14\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/running-with-systemd.html)**
```auto
systemctl status filebeat
systemctl stop filebeat
systemctl start filebeat
```
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [August 18, 2021, 9:07pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/4 "2021-08-18T21:07:37Z")
This doesn't look standard, is it possible someone made a custom unique install (AKA Snowflake)?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 18, 2021, 9:09pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/5 "2021-08-18T21:09:18Z")
I would tend to agree with @rugenl
---
### Author:  [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)
#### Post date: [August 19, 2021, 1:25am UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/6 "2021-08-19T01:25:00Z")
I do not have any idea on this. It was installed by someone who isn't in the org anymore and the KT is lost.
I'm gonna go with `service` cmds since `service status filebeat` seems to work fine.
---
### Author:  [@GitSpree23](https://discuss.elastic.co/u/GitSpree23)
#### Post date: [August 19, 2021, 5:16am UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/7 "2021-08-19T05:16:09Z")
These steps worked to upgrade the service Logstash (v2.2 to v7.x) consuming data from Filebeat (v7.8):
```auto
# Steps followed (in order):
service filebeat stop
ps -eaf | grep filebeat
service logstash stop
ps -eaf | grep logstash
sudo apt remove logstash
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt-get install apt-transport-https
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list
sudo apt-get install logstash
apt-get update
service logstash status # returns `logstash stop/waiting`
# modify `/etc/logstash/pipelines.yml`
# modify/remove/add the required .conf files in `/etc/logstash/conf.d/`
service logstash start
ps -eaf | grep logstash
service filebeat start
ps -eaf | grep filebeat
```
I tried upgrading to v7.13.x based on compatibility matrix, using the following cmd:
`echo "deb https://artifacts.elastic.co/packages/7.13.4/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.13.4.list`
But v7.14 got installed anyway. And the pipeline is working great, and the results are as expected.
Will that cause future Filebeat compatibility issues?
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [August 19, 2021, 1:21pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/8 "2021-08-19T13:21:47Z")
I didn't read all the change nodes, but the run of 7.13.x and 7.14 seems to have been mostly security fixes in Elasticsearch. IMHO, the beats often get released just to keep the versions in sync.
FYI, there are other posts about filebeat-god like [Filebeat-god description? - #3 by paulkeogh](https://discuss.elastic.co/t/filebeat-god-description/57281/3). Did you notice what your old version of filebeat was? I wonder if it was older, I don't find file in my current install.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 16, 2021, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-god-restart/281723/9 "2021-09-16T15:21:53Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.