# Filebeat not logging to /var/log/filebeat

**URL:** <https://discuss.elastic.co/t/filebeat-not-logging-to-var-log-filebeat/227001>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 7, 2020, 8:00pm UTC](https://discuss.elastic.co/t/filebeat-not-logging-to-var-log-filebeat/227001 "2020-04-07T20:00:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![newmember](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@newmember](https://discuss.elastic.co/u/newmember)\
**Post date:** [April 7, 2020, 8:00pm UTC](https://discuss.elastic.co/t/filebeat-not-logging-to-var-log-filebeat/227001/1 "2020-04-07T20:00:50Z")

</div>

I read this reference:

```auto
https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846

```

I am on Ubuntu 18.04  
Installed filebeat from the package:

```auto
root@chris-Standard-PC-Q35-ICH9-2009:/etc# apt list filebeat
Listing... Done
filebeat/now 7.6.2 amd64 [installed,local]

```

Filebeat Service:

```auto
root@chris-Standard-PC-Q35-ICH9-2009:/etc# service filebeat status
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue 2020-04-07 13:32:02 MDT; 6min ago
     Docs: https://www.elastic.co/products/beats/filebeat
 Main PID: 25716 (filebeat)
    Tasks: 12 (limit: 4915)
   CGroup: /system.slice/filebeat.service
           └─25716 /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebteat

```

I added logging to filebeat.yml

```auto
#================================ Logging =====================================

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]

logging.level: debug
#logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

```

At this point the logging is to syslog

For checking I ran the same start command from the service WITHOUT the "-e"

```auto
root@chris-Standard-PC-Q35-ICH9-2009:/var/log/filebeat# /usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeatpath.logs /var/log/filebeat &
[1] 32443

```

I can see the log files now

```auto
root@chris-Standard-PC-Q35-ICH9-2009:/var/log/filebeat# ls
filebeat filebeat.1

```

**Summary:**

I see the filebeat service start is using the "-e" option which is default from the filebeat package.

In /etc/init.d/filebeat there is this line:

```auto
# Do NOT "set -e"

```

**Question:**

How do I remove the "-e" from the filebeat service?  
Is this correct approach to get the logging to work to the /var/log/filebeat folder?

Thanks

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [April 8, 2020, 2:39am UTC](https://discuss.elastic.co/t/filebeat-not-logging-to-var-log-filebeat/227001/2 "2020-04-08T02:39:14Z")

</div>

See this: [https://www.elastic.co/guide/en/beats/filebeat/7.1/running-with-systemd.html#\_customize\_systemd\_unit\_for\_filebeat](https://www.elastic.co/guide/en/beats/filebeat/7.1/running-with-systemd.html#_customize_systemd_unit_for_filebeat)

I think you create a file /etc/systemd/system/filebeat.service.d/debug.conf containing

```
[Service]
Environment="BEAT_LOG_OPTS="
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 6, 2020, 2:39am UTC](https://discuss.elastic.co/t/filebeat-not-logging-to-var-log-filebeat/227001/3 "2020-05-06T02:39:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.