Metricbeat -c /etc/metricbeat.yml logs goes to the path specified , when stating with systemctl it does not

Elastic Security SIEM
1

Hi All,
Good morning
I am experiencing a strange observation here with logs
when I run

metricbeat -c /etc/metricbeat/metricbeat.yml

the logs goes to the specified location else not going, ie when started as service

"systemctl start metricbeat"

the log goes to the syslog
the contents of metricbeat.yml is given by

logging.level: debug
logging.to_files: true
logging.files:
path: /var/log/metricbeat

My package details are
Elasticsearch 7.4.2, Kibana 7.4.2 , Auditbeat 7.4.2 , FileBeat 7.4.2, LogStash 7.4.2-1 , Metricbeat 7.4.2

2

like to update from the clients
CentOS 6 the logs goes to the specified path
CentOS 7 , the logs do not go
Ubuntu 18.04 the logs do not go to the specified path

3

Can you check with ps -ef to see if -c /etc/metricbeat/metricbeat.yml is passed as a parameter when you start via systemctl?

4

Thanks Tudor,
my systemctl status shows

systemctl status metricbeat
● metricbeat.service - Metricbeat is a lightweight shipper for metrics.
Loaded: loaded (/usr/lib/systemd/system/metricbeat.service; disabled; vendor preset: disabled)
Active: active (running) since Wed 2019-11-13 14:55:26 +04; 11s ago
Docs: Metricbeat: Lightweight Shipper for Metrics | Elastic
Main PID: 24152 (metricbeat)
Tasks: 10
CGroup: /system.slice/metricbeat.service
└─24152 /usr/share/metricbeat/bin/metricbeat -e -c /etc/metricbeat/metricbeat.yml -path.home /usr/sh...

and for the ps -ef

ps -ef | grep metric
root 24152 1 1 14:55 ? 00:00:01 /usr/share/metricbeat/bin/metricbeat -e -c /etc/metricbeat/metricbeat.yml -path.home /usr/share/metricbeat -path.config /etc/metricbeat -path.data /var/lib/metricbeat -path.logs /var/log/metricbeat

5

I have installed metricbeat 7.4.2-1 in 2 machines to monitor the postgresql parameters

  • One in Ubuntu 18.04
  • One in CentOS 7.6.1810

Following are the observation
In Ubuntu, I get logs on the files which I specify, my DB details are shown on the dashboard
In CentOS 7, I do not get logs on the files which I specify, when I run “systemctl restart metricbeat”
I can see the messages in
/var/log/messages not in the path which I specified in the yml files

the contents for logs in /etc/metricbeat/metricbeat.yml

logging.to_files: true
logging.files:
path: /var/log/metricbeat
name: metricbeat.log
logging.level: debug

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.