# Filebeat refuses to log to file (7.0.1)

**URL:** <https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 20, 2019, 2:12pm UTC](https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846 "2019-05-20T14:12:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![buzzlightyear](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@buzzlightyear](https://discuss.elastic.co/u/buzzlightyear)\
**Post date:** [May 20, 2019, 2:12pm UTC](https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846/1 "2019-05-20T14:12:03Z")

</div>

Filebeat is configured to log to /var/log/filebeat, but it only logs to syslog. /var/log/filebeat directory does exist, and filebeat logs no error or warning to syslog to indicate any issues with logging to files.

I've got elasticsearch, logstash, filebeat and kibana installed, version 7.0.1 for all components. Installation was done via yum and using the elasticsearch 7 repo. OS is CentOS 7.

yum config:

```
[elasticsearch-7.x]
name=Elasticsearch repository for 7.x packages
baseurl=https://artifacts.elastic.co/packages/7.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md

```

Logging configuration from filebeat.yml:

```
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: info

# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
logging.selectors: ["publish"]
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
  interval: 24h

```

I would really appreciate any pointers to how to get it to log to the correct place.

---

<div class="post-metadata">

**Author:** ![martinr\_ubi](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@martinr\_ubi](https://discuss.elastic.co/u/martinr_ubi)\
**Post date:** [May 21, 2019, 5:11am UTC](https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846/2 "2019-05-21T05:11:09Z")

</div>

Hi,

**Thank you** for including all those details and formatting them correctly, that should make it quite easy and pleasant for me to hopefully help you very quickly.

From:

> **[Filebeat and systemd | Filebeat Reference \[7.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.0/running-with-systemd.html)**

> The unit file included in the packages sets the `-e` flag by default. This flag makes Filebeat log to stderr and disables other log outputs. Systemd stores all output sent to stderr in journald.

> The systemd service unit file includes environment variables that you can override to change the default options.

> To override these variables, create a drop-in unit file in the `/etc/systemd/system/filebeat.service.d` directory.

> To use [the logging] settings from the Filebeat file, empty the environment variable. For example:

```auto
[Service]
Environment="BEAT_LOG_OPTS="

```

> To apply your changes, reload the systemd configuration and restart the service:

```auto
systemctl daemon-reload
systemctl restart filebeat

```

> It is recommended that you use a configuration management tool to include drop-in unit files. If you need to add a drop-in manually, use `systemctl edit filebeat.service` .

Reference for the command line of filebeat to understand what the unit file does and what it can do:

> **[Filebeat command reference | Filebeat Reference \[7.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.0/command-line-options.html#global-flags)**

To see the default filebeat unit file that came with the installation do:

```auto
systemctl status filebeat

```

and check the content of the unit file. (The path to the unit file is in the output of the above command.)

If you think this is confusing a bit because the settings you put in the config files are ignored, you now know why; "-e".  
I would tend to agree this is confusing but the reasons for doing it from the POV of Elastic are valid.

From:

> **[Beats version 7.0.0 | Beats Platform Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-7.0.0.html)**

> - On systems with systemd, the Beats log is now written to journald by default rather than file. To revert this behaviour override BEAT\_LOG\_OPTS with an empty value. [8942](https://github.com/elastic/beats/pull/8942).

See:

> <https://github.com/elastic/beats/pull/8942>
>
> Add \`-e\` flag to command line when running beats from systemd so beats logs are …collected by journald by default in systems with systemd.
> 
> Add also some environment variables so command line flags can be more easily overriden with a drop-in unit or with \`systemctl edit\`.
> 
> Add documentation about the use of Beats with systemd.

I do think they missed an opportunity to link to:

> **[Filebeat and systemd | Filebeat Reference \[7.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.0/running-with-systemd.html)**

from:

> **[Configure logging | Filebeat Reference \[7.0\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.0/configuration-logging.html)**

with a warning/note that logging configurations from the config file will be completely overridden by the unit file on systemd systems and clearly inviting users to go read the "running with systemd" documentation page.

If you want to open an issue on github to suggest that documentation improvement that would be a good thing.

Let me know if this helps.

---

<div class="post-metadata">

**Author:** ![buzzlightyear](https://avatars.discourse-cdn.com/v4/letter/b/3da27b/32.png) [@buzzlightyear](https://discuss.elastic.co/u/buzzlightyear)\
**Post date:** [May 21, 2019, 7:41am UTC](https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846/3 "2019-05-21T07:41:22Z")

</div>

Great feedback, thank you!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2019, 7:41am UTC](https://discuss.elastic.co/t/filebeat-refuses-to-log-to-file-7-0-1/181846/4 "2019-06-18T07:41:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.