No logs found for filebeat

Elastic Stack Beats
1

Hello,

I am using filebeat 7.10 on Debian machine and I configured it to send data to /var/log/filebeat :

logging.level: info
logging.to_file: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644

and when i see the /var/log/filebeat/filebeat.log I just find:

2020-12-03T10:41:14.621+0100	INFO	instance/beat.go:645	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-12-03T10:41:14.621+0100	INFO	instance/beat.go:653	Beat ID: d45465ab-6750-476a-9f32-f5812968b5e8

The permission in the folder /var/log/filebeat:

Access: (0765/drwxrw-r-x)  Uid: (    0/    root)   Gid: (    0/    root)

and the permission in the filebeat file that is created automatically by filebeat:

Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)

To run filebeat I am running the command:

sudo systemctl start filebeat

Knowing that when I run sudo journalctl -u filebeat.service I get all the logs
Any help please!
Thanks

2

Filebeat log is in the /var/log/messages or /var/log/syslog

Try to run this command:

tail -f /var/log/messages | grep filebeat
3

thanks for your answer @fadjar340,
but I have added these lignes to have a file just for filebeat logs as it's mentionned in the documentation:

4

Try this:

logging.level: debug
logging.selector: *
logging.to_file: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7

Will show everything of the filebeat logs

5

Unfortunately even with debug level I am getting no log :frowning:

6

As per documentation:

logging.level: debug
logging.selector: *
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7

image
image765×227 13.1 KB

7

Yes I am already using logging.to_files: true

8

Take a look, because in the initial post you have logging.to_file: true in the configuration instead of logging.to_files and that could be the problem.

1 Like
9

Ohhh thank you @dacamposol, you were right I didn't pay attention to that, now it's working
Thanks for you @dacamposol and for you @fadjar340 :slight_smile:

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.