Filebeat not Generating Service Logs in Windows 10

Elastic Stack Beats
1

Filebeat is not generating service logs.
It was installed using the script ".\install-service-filebeat.ps1"

It was generating logs few hours ago, it stops generating logs after I deleted the "logs" directory.
All configurations are left default with only changing output from Elasticsearch to Logstash.

OS version: Windows 10 version 1909 (OS Build 18363.778)

Filebeat version:
filebeat version 7.6.2 (386), libbeat 7.6.2 [d57bcf8684602e15000d65b75afcd110e2b12b59 built 2020-03-26 05:25:24 +0000 UTC]

2

[UPDATE]

Even not working if I uninstall the service, remove the whole directory, unzip the package and install the service again. There is still no "logs" directory existing.

3

[UPDATE]

The log path is specified in the script install-service-filebeat.bat

New-Service -name filebeat `
  -displayName Filebeat `
  -binaryPathName "`"$workdir\filebeat.exe`" -c `"$workdir\filebeat.yml`" -path.home `"$workdir`" -path.data `"C:\ProgramData\filebeat`" -path.logs `"C:\ProgramData\filebeat\logs`" -E logging.files.redirect_stderr=true"

The path data and logs are hard coded, which is not what defines in the directory layout docs [1]
Explicitly specify the log path using logging.files.path: "C:/filebeat/logs" will solve the problem.

Just wondering why it is hard coded in the powershell script?

[1] https://www.elastic.co/guide/en/beats/filebeat/current/directory-layout.html#_zip_tar_gz_or_tgz

4

ProgramData is usually a more appropriate directory for storing data files, e.g. logs. Feel free to modify the script to your needs.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.