Filebeat on Centos7 not properly starting or logging

[bdobsonbcm (Bryan Dobson)]

Filebeat Version 7.1.1

I have been using Filebeat, without issue on our CentOS6 machines and have started to roll it out to our CentOS7 machines. I have installed via the following repository:

[elasticsearch-7.x]

name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

However, it only logs to /var/log/messages, does not use /var/log/filebeat and I do not believe is even looking at the right configuration file.

If I run the following (/usr/bin/filebeat -e -c /etc/filebeat/filebeat.yml) but if I start it on CentOS7 via the standard: systemctl start filebeat it fails to log to /var/log/filebeat and does not start properly at all.

[martinr_ubi (Martin R.)]

Hi,

You'll have to split those issues since they are different, logging/starting.
But I think you will be able to just continue with the "not starting at all" if you read the following about the logs not going where you want:

Filebeat refuses to log to file (7.0.1)

Filebeat is configured to log to /var/log/filebeat, but it only logs to syslog. /var/log/filebeat directory does exist, and filebeat logs no error or warning to syslog to indicate any issues with logging to files. I've got elasticsearch, logstash, filebeat and kibana installed, version 7.0.1 for all components. Installation was done via yum and using the elasticsearch 7 repo. OS is CentOS 7. yum config: [elasticsearch-7.x] name=Elasticsearch repository for 7.x packages baseurl=https://artifac…

Auditbeat 7.x on CentOS 7 logging to /var/log/messages

It will ignore any settings in the service or the auditbeat.yml and always log straight to var log messages. This issue doesn't occur in RHEL 7.

Fix the logging, or not and then give us more information about the "not starting" part by sharing things like your config, properly enclosed in triple backticks like ``` , and the output of the following (also properly enclosed):

sudo journalctl -u filebeat.service

sudo systemctl status filebeat

sudo systemctl start filebeat

If you changed anything else after you installed filebeat via yum, describe and share those changes too.

[bdobsonbcm (Bryan Dobson)]

My apologizes, I did not realize the intended behaviour in systemd was to go to /var/log/messages and if that is default I would prefer to keep it that way. I should have looked for this instead of using an assumption.

Regarding my other issue I found several problems with the filebeat.yml (typing errors) and this issue can be closed out.