# Filebeat on Centos7 not properly starting or logging

**URL:** <https://discuss.elastic.co/t/filebeat-on-centos7-not-properly-starting-or-logging/184646>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 6, 2019, 6:37pm UTC](https://discuss.elastic.co/t/filebeat-on-centos7-not-properly-starting-or-logging/184646 "2019-06-06T18:37:55Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [June 6, 2019, 10:50pm UTC](https://discuss.elastic.co/t/filebeat-on-centos7-not-properly-starting-or-logging/184646/2 "2019-06-06T22:50:49Z")

</div>

Hi,

You'll have to split those issues since they are different, logging/starting.  
But I think you will be able to just continue with the "not starting at all" if you read the following about the logs not going where you want:

> [@Filebeat refuses to log to file (7.0.1)](https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846):
>
> Filebeat is configured to log to /var/log/filebeat, but it only logs to syslog. /var/log/filebeat directory does exist, and filebeat logs no error or warning to syslog to indicate any issues with logging to files. I've got elasticsearch, logstash, filebeat and kibana installed, version 7.0.1 for all components. Installation was done via yum and using the elasticsearch 7 repo. OS is CentOS 7. yum config: [elasticsearch-7.x] name=Elasticsearch repository for 7.x packages baseurl=https://artifac…

> [@Auditbeat 7.x on CentOS 7 logging to /var/log/messages](https://discuss.elastic.co/t/auditbeat-7-x-on-centos-7-logging-to-var-log-messages/183421):
>
> It will ignore any settings in the service or the auditbeat.yml and always log straight to var log messages. This issue doesn't occur in RHEL 7.

Fix the logging, or not and then give us more information about the "not starting" part by sharing things like your config, properly enclosed in triple backticks like ``` , and the output of the following (also properly enclosed):

```auto
sudo journalctl -u filebeat.service

```

```auto
sudo systemctl status filebeat

```

```auto
sudo systemctl start filebeat

```

If you changed anything else after you installed filebeat via yum, describe and share those changes too.

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-on-centos7-not-properly-starting-or-logging/184646)._