Filebeat service failing to start

Elastic Stack Beats
1

Ever since updating to 7.9.2, filebeat has failed to start as a service.

Ubuntu 20.04.1 LTS (Focal Fossa)

systemctl status filebeat
ā— filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/lib/systemd/system/filebeat.service; enabled; vendor preset: enabled)
     Active: failed (Result: exit-code) since Tue 2020-10-06 18:57:45 MDT; 414ms ago
       Docs: https://www.elastic.co/products/beats/filebeat
    Process: 5939 ExecStart=/usr/share/filebeat/bin/filebeat --environment systemd $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, stat>
   Main PID: 5939 (code=exited, status=1/FAILURE)

Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Start request repeated too quickly.
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Failed with result 'exit-code'.
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..

Tried re-installing the packages.
Tried removing the service completely.
Have tried to stop and restart the service many times.

I cannot figure out why it is failing.

2

Any filebeat logs? There may be error messages there. There's not enough info here to help.

3

I was thinking the same thing but there are no log entries at all regarding the service error. If I run filebeat manually then the logs show new data but nothing via systemctl

4

Are you able to see any useful logs from journalctl -xe -u filebeat ?

2 Likes
5

Yes that was the command I did not know and it shows the problem

Oct 06 18:57:45 lubuntu-imac07 filebeat[5939]: Exiting: error loading config file: config file ("/etc/filebeat/filebeat.yml") must be owned by the user identifier (uid=0) or root
Oct 06 18:57:45 lubuntu-imac07 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE
-- Subject: Unit process exited
-- Defined-By: systemd
-- Support: http://www.ubuntu.com/support
--
-- An ExecStart= process belonging to unit filebeat.service has exited.
--
-- The process' exit code is 'exited' and its exit status is 1.

I don't remember changing the permissions to the file but clearly that is the issue.

6

Refer to documentation below, it stated that:

You may encounter the following errors if your config file fails these checks:

Exiting: error loading config file: config file ("{beatname}.yml") must be owned by the beat user (uid=501) or root

To correct this problem you can use either chown root {beatname}.yml or chown 501 {beatname}.yml to change the owner of the configuration file.

1 Like
7

The is the weird thing about Linux that confuses me. Why does root have to own the file? If I set the ownership that the prevents my personal user from editing the file. Why can't it be both?

8

It explained in the first paragraph of link that I shared

On systems with POSIX file permissions, all Beats configuration files are subject to ownership and file permission checks. The purpose of these checks is to prevent unauthorized users from providing or modifying configurations that are run by the Beat. The owner of the configuration files must be either root or the user who is executing the Beat process. The permissions on each file must disallow writes by anyone other than the owner.

9

That makes sense. Thank you for the follow up.

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.