# Help setting up filebeat? (Selfhosted) **URL:** \ **Category:** Elastic Search\ **Tags:** elastic-app-search\ **Created:** [March 11, 2020, 5:04am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044 "2020-03-11T05:04:58Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![varunharidas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varunharidas/32/63704_2.png) [@varunharidas](https://discuss.elastic.co/u/varunharidas)\ **Post date:** [March 11, 2020, 5:04am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/1 "2020-03-11T05:04:58Z")
Everything else is working fine however can't find any guide to configuring filebeat for app search, I found a filebeat.yml file inside the app search folder, but no idea in setting it up. Already have file beat up and running using the config from /etc/filebeat/filebeat.yml. Pelase help! ---
**Author:** ![orhantoy](https://avatars.discourse-cdn.com/v4/letter/o/c5a1d2/32.png) [@orhantoy](https://discuss.elastic.co/u/orhantoy)\ **Post date:** [March 12, 2020, 11:56am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/2 "2020-03-12T11:56:34Z")
Filebeat is started automatically alongside App Search, so you shouldn't need to do anything extra. ---
**Author:** ![orhantoy](https://avatars.discourse-cdn.com/v4/letter/o/c5a1d2/32.png) [@orhantoy](https://discuss.elastic.co/u/orhantoy)\ **Post date:** [March 12, 2020, 11:58am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/3 "2020-03-12T11:58:56Z")
I'm assuming you're using version 7.5 or higher, if not there might be some differences in how you run App Search locally. ---
**Author:** ![varunharidas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varunharidas/32/63704_2.png) [@varunharidas](https://discuss.elastic.co/u/varunharidas)\ **Post date:** [March 12, 2020, 2:39pm UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/4 "2020-03-12T14:39:23Z")
Im running 7.6, so app-search will start an instance of filebeat on its own? So I don’t need to edit my /etc/filebeat config? ---
**Author:** ![varunharidas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varunharidas/32/63704_2.png) [@varunharidas](https://discuss.elastic.co/u/varunharidas)\ **Post date:** [March 12, 2020, 2:40pm UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/5 "2020-03-12T14:40:43Z")
But my Analytics isn’t working i checked the app search logs and it has all the api logs thing is its not transfered over to elastic by filebeat ---
**Author:** ![oleksiy-elastic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oleksiy-elastic/32/49074_2.png) [@oleksiy-elastic](https://discuss.elastic.co/u/oleksiy-elastic)\ **Post date:** [March 12, 2020, 3:27pm UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/6 "2020-03-12T15:27:28Z")
There should be a filebeat log file next to the app-server.log. It should clarify what's happening with logs delivery (both analytics and request logs). ---
**Author:** ![varunharidas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varunharidas/32/63704_2.png) [@varunharidas](https://discuss.elastic.co/u/varunharidas)\ **Post date:** [March 12, 2020, 4:54pm UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/7 "2020-03-12T16:54:15Z")
@oleksiy-elastic Thing is there are several filebeat logs named 1,2 ... repeatedly. So am i running the arch right? Running filebeat on my server on its own. ---
**Author:** ![varunharidas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varunharidas/32/63704_2.png) [@varunharidas](https://discuss.elastic.co/u/varunharidas)\ **Post date:** [March 13, 2020, 9:27am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/9 "2020-03-13T09:27:51Z")
Log was old so i stopped filebeat which i started and restarted app -search here is the log ``` ######################################################### Success! Elastic App Search is starting successfully. In a few moments, you'll be able to login at the following address: * Visit the documentation: https://swiftype.com/documentation/app-search Secret session key has been generated. Set the key in your config file to persist user sessions through process restarts: secret_session_key: 9f7df818a1a1d708e337d95ad6bbf2ee43797db8b11781724b33bb7a4751e1bc0ecb1ceeeab2c30c7b232ea0b2a4b090c9cf7189ac2e7eeb2dde03f771bb5384 ######################################################### [2020-03-13T09:22:37.820+00:00][18251][2272][app-server][INFO]: Running task: KeepFilebeatAlive [2020-03-13T09:22:38.128+00:00][18251][2272][cron-Work::Cron::KeepFilebeatAlive][INFO]: Performing task: KeepFilebeatAlive [2020-03-13T09:22:38.132+00:00][18251][2272][cron-Work::Cron::KeepFilebeatAlive][INFO]: Starting Filebeat [2020-03-13T09:22:38.267+00:00][18251][2272][cron-Work::Cron::KeepFilebeatAlive][INFO]: Started Filebeat [PID: #18363] [2020-03-13T09:22:38.269+00:00][18251][2272][cron-Work::Cron::KeepFilebeatAlive][INFO]: Done performing task: KeepFilebeatAlive [2020-03-13T09:22:38.401+00:00][18251][2284][app-server][INFO]: esqueues me while I process jobs on analytics_events, document_destroyer, engine_destroyer, index_adder, indexed_doc_remover, mailer, refresh_document_counts, reindexer, schema_updater [2020-03-13T09:22:38.403+00:00][18251][2272][app-server][INFO]: Done running task: KeepFilebeatAlive [2020-03-13T09:22:38.440+00:00][18251][2286][app-server][INFO]: esqueues me while I process jobs on analytics_events, document_destroyer, engine_destroyer, index_adder, indexed_doc_remover, mailer, refresh_document_counts, reindexer, schema_updater [2020-03-13T09:22:38.462+00:00][18251][2288][app-server][INFO]: esqueues me while I process jobs on analytics_events, document_destroyer, engine_destroyer, index_adder, indexed_doc_remover, mailer, refresh_document_counts, reindexer, schema_updater [2020-03-13T09:22:38.475+00:00][18251][2290][app-server][INFO]: esqueues me while I process jobs on analytics_events, document_destroyer, engine_destroyer, index_adder, indexed_doc_remover, mailer, refresh_document_counts, reindexer, schema_updater ``` ---
**Author:** ![orhantoy](https://avatars.discourse-cdn.com/v4/letter/o/c5a1d2/32.png) [@orhantoy](https://discuss.elastic.co/u/orhantoy)\ **Post date:** [March 27, 2020, 2:29pm UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/10 "2020-03-27T14:29:49Z")
The logs look as expected @varunharidas, for instance it is saying that it started its' own Filebeat process: `Started Filebeat [PID: #18363]`. Could you try to do this on a clean install because it could sound like you have tried to start Filebeat on its' own initially? ---
**Author:** ![varunharidas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/varunharidas/32/63704_2.png) [@varunharidas](https://discuss.elastic.co/u/varunharidas)\ **Post date:** [March 30, 2020, 3:38am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/11 "2020-03-30T03:38:43Z")
Yeah i think so, I was using Filebeat to ship my nginx log and filebeat starts automatically when my instance boots up, somehow it's working now. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 27, 2020, 3:40am UTC](https://discuss.elastic.co/t/help-setting-up-filebeat-selfhosted/223044/12 "2020-04-27T03:40:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.