Metricbeat - Not creating any logfile

Elastic Stack Beats
1

I am trying to set up metric beat for my CentOS7 host. I have explictly mentioned the logfile location for the metricbeat and the logging level is debug, but I dont see a log file created. I can see the logs in journalctl. Please let me know why the logfile is not creating. Same setting works with filebeat and the log file gets created.

root@example.domain.com:/usr/share/metricbeat# metricbeat version
metricbeat version 7.2.0 (amd64), libbeat 7.2.0 [9ba65d864ca37cd32c25b980dbb4020975288fc0 built 2019-06-20 15:07:31 +0000 UTC]

Metricbeat config file: /etc/metricbeat/metricbeat.yml

metricbeat:
  config:
    modules:
      path: /etc/metricbeat/modules.d/*.yml
      reload.enabled: true
      reload.period: 10s

output.logstash:
  hosts: ['logstash.domain.com:5158']
  worker: 1
  compression_level: 3
  loadbalance: true
  ssl:
    certificate: /usr/share/metricbeat/metricbeat.crt
    key: /usr/share/metricbeat/metricbeat.key
    verification_mode: none

logging:
  level: debug
  to_files: true
  files:
    path: /var/myapp/log/metricbeat
    name: metricbeat.log
    rotateeverybytes: 10485760
    keepfiles: 7

Ideally it should create a file (metricbeat.log) in /var/myapp/log/metricbeat location, but I dont see any files getting created.

Journalctl output:

* metricbeat.service - Metricbeat is a lightweight shipper for metrics.
   Loaded: loaded (/usr/lib/systemd/system/metricbeat.service; disabled; vendor preset: disabled)
   Active: active (running) since Mon 2022-01-24 08:51:13 PST; 39min ago
     Docs: https://www.elastic.co/products/beats/metricbeat
 Main PID: 13520 (metricbeat)
   CGroup: /system.slice/metricbeat.service
           `-13520 /usr/share/metricbeat/bin/metricbeat -e -c /etc/metricbeat/metricbeat.yml -path.home /usr/share/metricbeat -path.config /etc/metricbeat -path.data /var/lib/metricbeat -path.logs /var/log/metricbeat

Jan 24 09:30:14 example.domain.com metricbeat[13520]: "/var/lib/metricbeat",
Jan 24 09:30:14 example.domain.com metricbeat[13520]: "-path.logs",
Jan 24 09:30:14 example.domain.com metricbeat[13520]: "/var/log/metricbeat"
Jan 24 09:30:14 example.domain.com metricbeat[13520]: ]
Jan 24 09:30:14 example.domain.com metricbeat[13520]: },
Jan 24 09:30:14 example.domain.com metricbeat[13520]: "user": {
Jan 24 09:30:14 example.domain.com metricbeat[13520]: "name": "root"
Jan 24 09:30:14 example.domain.com metricbeat[13520]: },
Jan 24 09:30:14 example.domain.com metricbeat[13520]: "event": {
Jan 24 09:30:14 example.domain.com metricbeat[13520]: "module": "system",

I dont see any thing in "/var/log/metricbeat" directory as well.

EDIT: I tried with version 6.3 and 7.16. It works fine. Looks like some issue with 7.2

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.