Filebeat installation in linux

Elastic Stack Beats
1

Hi Team,

I installed the filebeat in linux environment using the rpm installation sudo install rpm filename. On observing that the default directory layout data folder "/var/lib/filebeat" and logs folder "/var/log/filebeat" are not created. Is this any issue. Do we need to create these folder manually? Can any one guide me why this happened. I am not able to see any logs whether the file beat is running or not. Please help me in this issue.

Thanks & Regards
Sri

2

Hi,

There is no need to create it manually. These folders are created when Filebeat is started.
If you run filebeat.sh -e, it logs to stderr, so you can see what is happening. If -e is not specified logs will be written to /var/log/filebeat/filebeat by default.

3

Thanks for the reply. I am running this as a service. using the below command:
sudo service filebeat start

How do I change the above command to use -e option? Can I add it at the end after start?

4

It is not possible to use -e option in sudo service filbeat start command. If you want to use this option, you have to modify the initscript which is not advised.
Does /var/log/filebeat/filebeat is created after you start the service? What is the return value of sudo service filebeat start?

5

The idea is to run filebeat in foreground for testing/debugging. Once you got the configuration to work, you can run filebeat as service again.