Filebeat running error

Elastic Stack Beats
1

Hi Team,
file beat is not starting as a service even after executing the command. It's showing the below status :

sudo systemctl status filebeat.service
[sudo] password for elkservice:
â filebeat.service - filebeat
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since Mon 2017-11-13 06:40:04 GMT; 32min ago
Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
Process: 31650 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
Main PID: 31650 (code=exited, status=1/FAILURE)

Nov 13 06:40:04 hofpreb2b1 systemd[1]: Unit filebeat.service entered failed state.
Nov 13 06:40:04 hofpreb2b1 systemd[1]: filebeat.service failed.
Nov 13 06:40:04 hofpreb2b1 systemd[1]: filebeat.service holdoff time over, scheduling restart.
Nov 13 06:40:04 hofpreb2b1 systemd[1]: start request repeated too quickly for filebeat.service
Nov 13 06:40:04 hofpreb2b1 systemd[1]: Failed to start filebeat.
Nov 13 06:40:04 hofpreb2b1 systemd[1]: Unit filebeat.service entered failed state.
Nov 13 06:40:04 hofpreb2b1 systemd[1]: filebeat.service failed.

Earlier the software was installed using rpm and it used to work without any issues with the root user. Now a new user is created with sudo permissions and we are trying to start the service. It's not starting.

Can some one help me.

2

Please format logs, terminal output and configs using the </>-button.

You also have some filebeat logs?

Have you tried to start filebeat in the terminal, without systemd?

3

Hi Steffens,
Thanks for the reply. The issue is lack of permissions. When tried with the permissions the service is running as root instead of application user and the logs are created with option -rw-------. Not able to see teh logs as the user is not root user.

Manually i tried to run the service with the below command :
/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /usr/share/filebeat/bin/data -path.logs /var/log/filebeat but this is not running continuously. When i closed teh terminal it's exiting.

Can you help me with it

Regards
Srinivas V

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.