# Metricbeat -c /etc/metricbeat.yml logs goes to the path specified , when stating with systemctl it does not **URL:** \ **Category:** SIEM\ **Created:** [November 3, 2019, 7:51am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273 "2019-11-03T07:51:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Joseph\_John](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joseph_john/32/53907_2.png) [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Post date:** [November 3, 2019, 7:51am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273/1 "2019-11-03T07:51:10Z")
Hi All, Good morning I am experiencing a strange observation here with logs when I run > metricbeat -c /etc/metricbeat/metricbeat.yml the logs goes to the specified location else not going, ie when started as service > "systemctl start metricbeat" the log goes to the syslog the contents of metricbeat.yml is given by > logging.level: debug > logging.to\_files: true > logging.files: > path: /var/log/metricbeat My package details are **Elasticsearch** 7.4.2, **Kibana** 7.4.2 , **Auditbeat** 7.4.2 , **FileBeat** 7.4.2, **LogStash** 7.4.2-1 , **Metricbeat** 7.4.2 ---
**Author:** ![Joseph\_John](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joseph_john/32/53907_2.png) [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Post date:** [November 4, 2019, 11:35am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273/2 "2019-11-04T11:35:21Z")
like to update from the clients **CentOS 6** the logs **goes** to the specified path **CentOS 7** , the logs **do not go** **Ubuntu 18.04** the logs **do not go** to the specified path ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [November 13, 2019, 10:41am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273/3 "2019-11-13T10:41:19Z")
Can you check with `ps -ef` to see if `-c /etc/metricbeat/metricbeat.yml` is passed as a parameter when you start via systemctl? ---
**Author:** ![Joseph\_John](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joseph_john/32/53907_2.png) [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Post date:** [November 13, 2019, 10:51am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273/4 "2019-11-13T10:51:42Z")
Thanks Tudor, my systemctl status shows **systemctl status metricbeat** ● metricbeat.service - Metricbeat is a lightweight shipper for metrics. Loaded: loaded (/usr/lib/systemd/system/metricbeat.service; disabled; vendor preset: disabled) Active: active (running) since Wed 2019-11-13 14:55:26 +04; 11s ago Docs: [Metricbeat: Lightweight Shipper for Metrics | Elastic](https://www.elastic.co/products/beats/metricbeat) Main PID: 24152 (metricbeat) Tasks: 10 CGroup: /system.slice/metricbeat.service └─24152 /usr/share/metricbeat/bin/ **metricbeat -e -c /etc/metricbeat/metricbeat.yml** -path.home /usr/sh... and for the **ps -ef** > ps -ef | grep metric > root 24152 1 1 14:55 ? 00:00:01 /usr/share/metricbeat/bin/metricbeat -e -c /etc/metricbeat/metricbeat.yml -path.home /usr/share/metricbeat -path.config /etc/metricbeat -path.data /var/lib/metricbeat -path.logs /var/log/metricbeat ---
**Author:** ![Joseph\_John](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joseph_john/32/53907_2.png) [@Joseph\_John](https://discuss.elastic.co/u/Joseph_John)\ **Post date:** [November 13, 2019, 10:54am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273/5 "2019-11-13T10:54:22Z")
I have installed **metricbeat 7.4.2-1** in 2 machines to monitor the postgresql parameters - One in Ubuntu 18.04 - One in CentOS 7.6.1810 Following are the observation In Ubuntu, I get logs on the files which I specify, my DB details are shown on the dashboard In CentOS 7, I do not get logs on the files which I specify, when I run “systemctl restart metricbeat” I can see the messages in **/var/log/messages** not in the path which I specified in the **yml files** the contents for logs in /etc/metricbeat/metricbeat.yml > logging.to\_files: true > logging.files: > path: /var/log/metricbeat > name: metricbeat.log > logging.level: debug ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 11, 2019, 10:54am UTC](https://discuss.elastic.co/t/metricbeat-c-etc-metricbeat-yml-logs-goes-to-the-path-specified-when-stating-with-systemctl-it-does-not/206273/6 "2019-12-11T10:54:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.