# Metricbeat and Packetbeat

**URL:** <https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809>\
**Category:** Beats\
**Created:** [October 10, 2018, 10:01am UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809 "2018-10-10T10:01:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![aviral\_srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aviral_srivastava/32/98018_2.png) [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\
**Post date:** [October 10, 2018, 10:01am UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809/1 "2018-10-10T10:01:46Z")

</div>

Hi,

My Linux system configuration shows

> cat /etc/os-release

NAME="Red Hat Enterprise Linux Server"  
VERSION="7.4 (Maipo)"  
ID="rhel"  
ID\_LIKE="fedora"  
VARIANT="Server"  
VARIANT\_ID="server"  
VERSION\_ID="7.4"  
PRETTY\_NAME="Red Hat Enterprise Linux Server 7.4 (Maipo)"  
ANSI\_COLOR="0;31"  
CPE\_NAME="cpe:/o:redhat:enterprise\_linux:7.4:GA:server"  
HOME\_URL="[https://www.redhat.com/](https://www.redhat.com/)"  
BUG\_REPORT\_URL="[https://bugzilla.redhat.com/](https://bugzilla.redhat.com/)"

REDHAT\_BUGZILLA\_PRODUCT="Red Hat Enterprise Linux 7"  
REDHAT\_BUGZILLA\_PRODUCT\_VERSION=7.4  
REDHAT\_SUPPORT\_PRODUCT="Red Hat Enterprise Linux"  
REDHAT\_SUPPORT\_PRODUCT\_VERSION="7.4"

> uname -m

x86\_64

Can I install any one of them : metricbeat 6.4.0 [RPM 64-bit] or metricbeat 6.4.0 [LINUX 64-bit] ?  
If not then why what does difference will it make, based on my system configuration ?  
Similarly for Packetbeat 6.4.0

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 10, 2018, 10:06am UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809/2 "2018-10-10T10:06:49Z")

</div>

You should really install using the RPM repo, it will make upgrades easier.

---

<div class="post-metadata">

**Author:** ![aviral\_srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aviral_srivastava/32/98018_2.png) [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\
**Post date:** [October 11, 2018, 11:59am UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809/3 "2018-10-11T11:59:33Z")

</div>

Thanks for the reply. I have installed metricbeat-6.4.0-x86\_64.rpm

I ran below commands from path: /home/appm  
curl -L -O [https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-6.4.0-x86\_64.rpm](https://artifacts.elastic.co/downloads/beats/metricbeat/metricbeat-6.4.0-x86_64.rpm)  
sudo rpm -vi metricbeat-6.4.0-x86\_64.rpm

According to the documentation, For rpm and deb, you’ll find the configuration file at `/etc/metricbeat/metricbeat.yml

But metricbeat.yml, is also present at location : /home/appm/metricbeat-6.4.0-linux-x86\_64 folder

Why I am getting this at 2 locations and which file to modify ?

---

<div class="post-metadata">

**Author:** ![faulander](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faulander/32/36344_2.png) [@faulander](https://discuss.elastic.co/u/faulander)\
**Post date:** [October 11, 2018, 12:47pm UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809/4 "2018-10-11T12:47:38Z")

</div>

Correct location for metricbeat is /etc/metricbeat.  
It depends on the service installation, actually it doesn't matter where metricbeat.yml file is located, it's an arguments parsed to the metricbeat executable.

Is your system running with SystemD? Then you can check:  
"/etc/systemd/system/multi-user.target.wants/metricbeat.service"  
Line:  
ExecStart=/usr/share/metricbeat/bin/metricbeat -c /etc/metricbeat/metricbeat.yml

the argument passed with "-c" is the metricbeat.yml used.

---

<div class="post-metadata">

**Author:** ![aviral\_srivastava](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aviral_srivastava/32/98018_2.png) [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\
**Post date:** [October 16, 2018, 5:38pm UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809/5 "2018-10-16T17:38:34Z")

</div>

I started the metricbeat service using below command:  
sudo service metricbeat start  
Starting metricbeat (via systemctl): [OK]

It looks like metricbeat started successfully. But I am not getting any data in my elasticsearch node. I am also not able to access logs from folder /var/log/metricbeat folder  
-bash: cd: metricbeat: Permission denied

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 13, 2018, 7:40pm UTC](https://discuss.elastic.co/t/metricbeat-and-packetbeat/151809/6 "2018-11-13T19:40:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
