How to restart Filebeat after adding a new prospector to filebeat.yml?

Elastic Stack Beats
1

I downloaded Filebeat from (https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-5.2.2-linux-x86_64.tar.gz) and extracted the tar on my Ubuntu 14.04 machine.
I run Filebeat on my Ubuntu terminal with the following command:
./filebeat -c filebeat.yml

I want to add new prospectors to filebeat.yml and then restart Filebeat. How to restart filebeat extracted from the downloaded tar? Does running the command <./filebeat -c filebeat.yml>
again ensure previous filebeat gets stopped and filebeat starts again from where it let off?
Thanks!

2

I would recommend using DEB download and the init script to start/stop/restart Filebeat:

sudo /etc/initi.d/filebeat start
sudo /etc/initi.d/filebeat stop
sudo /etc/initi.d/filebeat restart

If you don't want to use the init script, you need to kill the old instance, before starting the new one. You can do that by pressing Control-C in the console, or by using the kill <pid> command.

3

Thanks for your response @tudor . I am concerned about my access rights to /etc directory. So I would like to extract the tar in one of my directories and then execute Filebeat. Also, I want to do restart Filebeat without being concerned about killing existing Filebeat process(the way it happens in sudo /etc/init.d/filebeat restart).

Just to confirm, I tried running command <./filebeat -c filebeat.yml> every time I wanted to add a new prospector to filebeat.yml. When I checked running processes using command (ps -A) on my system after executing <./filebeat -c filebeat.yml> n times, I see n filebeat processes running.

Do you see any scope of this restart functionality be taken as an enhancement in Filebeat?

4

We do not plan a restarting functionality in Filebeat itself, because we see this as something that needs to happen outside of the process, but we do plan to release a configuration reloading feature. This means that you will be able to add a new prospector to an existing Filebeat instance by dropping a new file in a folder: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-configuration-reloading.html

5

Thanks! This will be a useful feature. Any idea, when this feature is expected to be released?

6

It's going to be released as experimental in 5.3, which might show up as early as next week. It's experimental, though.

7

Two questions: Is this currently IN 5.3 as experimental? And if so, how do we actually need to access it? Does the whole new file need to be dropped in / replace the existing config yml? We are looking at setting up CI/CD from a repo to change things like add a new Prospector, and this is exactly what we are needing... (and I think we are looking at or possibly already working with 5.3)

8

It is in 5.3. Check the doc link tudor posted above: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-configuration-reloading.html

It works very similar to a conf.d directory.

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.