# Filebeat Logging on Centos 7

**URL:** <https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 26, 2019, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629 "2019-06-26T16:38:24Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kjenney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kjenney/32/48848_2.png) [@kjenney](https://discuss.elastic.co/u/kjenney)\
**Post date:** [June 26, 2019, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629/1 "2019-06-26T16:38:24Z")

</div>

I'm trying to get the Filebeat service to log to /var/log/filebeat.log on Centos 7. I added the following to the config:

```
logging.level: debug
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

```

Logs are still going to /var/log/messages and are not going to /var/log/filebeat. The file isn't even being created - even though the process is running as root. Selinux is set to permissive. How can I get Filebeat to log correctly?

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [June 26, 2019, 8:46pm UTC](https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629/2 "2019-06-26T20:46:01Z")

</div>

Hi Kenneth, thanks for reaching out about filebeat on CentOS 7. Your configuration looks like what is recommended [here](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html).

After you saved the config, did you restart filebeat?

```auto
systemctl stop filebeat
systemctl start filebeat

```

There's also the following note. I've seen case where logs get stored only in journald. You may want to run `journalctl -u filebeat.service` to see if the logs are getting stored in journald.

```auto
When Filebeat is running on a Linux system with systemd, it uses by default the -e command line option, that makes it write all the logging output to stderr so it can be captured by journald. Other outputs are disabled.

```

---

<div class="post-metadata">

**Author:** ![kjenney](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kjenney/32/48848_2.png) [@kjenney](https://discuss.elastic.co/u/kjenney)\
**Post date:** [June 27, 2019, 1:48am UTC](https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629/3 "2019-06-27T01:48:28Z")

</div>

The logs are stored in journald. Is there no way to override this?

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [June 27, 2019, 2:06am UTC](https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629/4 "2019-06-27T02:06:17Z")

</div>

It’s documented in the manual:  
[https://www.elastic.co/guide/en/beats/filebeat/current/running-with-systemd.html](https://www.elastic.co/guide/en/beats/filebeat/current/running-with-systemd.html)

That’s also linked from the logging manual page Michael linked to in his answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2019, 2:06am UTC](https://discuss.elastic.co/t/filebeat-logging-on-centos-7/187629/5 "2019-07-25T02:06:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.