Filebeat on Centos7 not properly starting or logging

Elastic Stack Beats
1

Filebeat Version 7.1.1

I have been using Filebeat, without issue on our CentOS6 machines and have started to roll it out to our CentOS7 machines. I have installed via the following repository:

[elasticsearch-7.x]

name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

However, it only logs to /var/log/messages, does not use /var/log/filebeat and I do not believe is even looking at the right configuration file.

If I run the following (/usr/bin/filebeat -e -c /etc/filebeat/filebeat.yml) but if I start it on CentOS7 via the standard: systemctl start filebeat it fails to log to /var/log/filebeat and does not start properly at all.

2

Hi,

You'll have to split those issues since they are different, logging/starting.
But I think you will be able to just continue with the "not starting at all" if you read the following about the logs not going where you want:

Fix the logging, or not and then give us more information about the "not starting" part by sharing things like your config, properly enclosed in triple backticks like ``` , and the output of the following (also properly enclosed):

sudo journalctl -u filebeat.service

sudo systemctl status filebeat

sudo systemctl start filebeat

If you changed anything else after you installed filebeat via yum, describe and share those changes too.

1 Like
3

My apologizes, I did not realize the intended behaviour in systemd was to go to /var/log/messages and if that is default I would prefer to keep it that way. I should have looked for this instead of using an assumption.

Regarding my other issue I found several problems with the filebeat.yml (typing errors) and this issue can be closed out.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.