How to restart Filebeat after adding a new prospector to filebeat.yml?

I downloaded Filebeat from ( and extracted the tar on my Ubuntu 14.04 machine.
I run Filebeat on my Ubuntu terminal with the following command:
./filebeat -c filebeat.yml

I want to add new prospectors to filebeat.yml and then restart Filebeat. How to restart filebeat extracted from the downloaded tar? Does running the command <./filebeat -c filebeat.yml>
again ensure previous filebeat gets stopped and filebeat starts again from where it let off?

I would recommend using DEB download and the init script to start/stop/restart Filebeat:

sudo /etc/initi.d/filebeat start
sudo /etc/initi.d/filebeat stop
sudo /etc/initi.d/filebeat restart

If you don't want to use the init script, you need to kill the old instance, before starting the new one. You can do that by pressing Control-C in the console, or by using the kill <pid> command.

Thanks for your response @tudor . I am concerned about my access rights to /etc directory. So I would like to extract the tar in one of my directories and then execute Filebeat. Also, I want to do restart Filebeat without being concerned about killing existing Filebeat process(the way it happens in sudo /etc/init.d/filebeat restart).

Just to confirm, I tried running command <./filebeat -c filebeat.yml> every time I wanted to add a new prospector to filebeat.yml. When I checked running processes using command (ps -A) on my system after executing <./filebeat -c filebeat.yml> n times, I see n filebeat processes running.

Do you see any scope of this restart functionality be taken as an enhancement in Filebeat?

We do not plan a restarting functionality in Filebeat itself, because we see this as something that needs to happen outside of the process, but we do plan to release a configuration reloading feature. This means that you will be able to add a new prospector to an existing Filebeat instance by dropping a new file in a folder:

Thanks! This will be a useful feature. Any idea, when this feature is expected to be released?

It's going to be released as experimental in 5.3, which might show up as early as next week. It's experimental, though.

Two questions: Is this currently IN 5.3 as experimental? And if so, how do we actually need to access it? Does the whole new file need to be dropped in / replace the existing config yml? We are looking at setting up CI/CD from a repo to change things like add a new Prospector, and this is exactly what we are needing... (and I think we are looking at or possibly already working with 5.3)

It is in 5.3. Check the doc link tudor posted above:

It works very similar to a conf.d directory.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.