Filebeat installation as service but under custom folder

Elastic Stack Beats
1

I have setup filbeat using below:
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-6.4.0-x86_64.rpm
sudo rpm -vi filebeat-6.4.0-x86_64.rpm

Filebeat is successfully set up as service, but the filebeat related files like filebeat.yml is created under /etc/filebeat/filebeat.yml and log file in /var/log/filebeat.

My question is can i install filebeat as service as above but all the filebeat related files should be under my custom folder say /opt/ELK/filebeat instead of /etc/filebeat/filebeat.yml or /var/log/filebeat.

Is this possible ?
Thanks in advance.

2

I have achieved this by using system service.Below are the details:

i have created filebeat.service with below details:
[Unit]
Description=filebeat

[Service]
ExecStart=/opt/ELK/filebeat.sh

[Install]
WantedBy=multi-user.target

and my filebeat.sh has below data:
#!/bin/sh
dstamp=date '+%Y%m%d%H%M'
LOG_FILE=/opt/ELK/filebeat.log
sDate=date '+%Y-%m-%d %r'

echo $sDate '::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::' >> $LOG_FILE

echo $sDate 'Start of filebeat' >> $LOG_FILE

cd /opt/ELK/filebeat-6.4.0-linux-x86_64
./filebeat -e -c filebeat.yml -d "publish"

echo $sDate 'END of filebeat' >> $LOG_FILE
echo $sDate '::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::' >> $LOG_FILE

after that run below commands:
systemctl enable filebeat
systemctl status filebeat
systemctl start filebeat
systemctl stop filebeat

3

Have you considered to install filebeat from the tgz file or create your own rpm based on the tgz file? When installing via rpm, the rpm database tracks installed packages and files/locations. Moving files kind of messes with these meta-data. Plus, when updating filebeat via rpm you don't want it to overwrite your systemd script.

4

Hey Steffens,

I installed filebeat from .tar.gz .
I have unzipped the tar.gz in my custom location it and made necessary changes to .yml file.
Then i have created services as per my requirement.

Thanks
Shivaprasad

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.