Filebeat.yml.rpmnew use?

[saisimo02 (Mohamed)]

Hi,
I installed recently filebeat, and I would like to edit the yml file to specify this input:
filebeat.prospectors:

- input_type: log


  paths:
    - /path/*.xml
  # scan_frequency: 60s
  document_type: message
  multiline.pattern: '^<measInfo'
  multiline.negate: true
  multiline.match: after

I should edit the file filebeat.yml or filebeat.yml.rpmnew?

When I edit filebeat.yml I get this message error :
> filebeat.service - filebeat

   Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
   Active: failed (Result: start-limit) since Thu 2018-07-19 11:35:40 CEST; 2s ago
     Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
  Process: 4695 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
 Main PID: 4695 (code=exited, status=1/FAILURE)

Thanks for your help.

[andrewkroh]

@saisimo02

I should edit the file filebeat.yml or filebeat.yml.rpmnew?

filebeat.yml.rpmnew is created by RPM when you update an RPM and have a modified config file. This is to prevent overwriting any changes you have made to a config file. The config the filebeat will read is /etc/filebeat/filebeat.yml.

If filebeat is not starting then you should check the contents of the log file for errors.

When you are making config file changes you can invoke filebeat test config -e to smoke test the config file. Additionally you can start Filebeat on the CLI if you want to watch it startup and see any errors on the CLI (filebeat run -e -d "*"). But don't do this while the systemd filebeat service is running.