On startup run filebeat restart upon fail

Elastic Stack Beats
1

On a test machine with Debian 10 with a desktop, filebeat did not startup after a hard VM reset.
I would like to be sure that on Debian systems with a desktop and headless systems this service restart it self upon failure ( restarting manual on the desktop system worked.. )

How to configure that on Debian
I'm a bit more into windows where its easy to set reset options for a service.

2

Hi Peter,

So in normal conditions, after you restart your VM Filebbeat would start without a problem. correct?
Do you want to make sure if filebeat service failed for some reason it would automatically restart itself?

3

Yes your correct normally it should start when the system startup.
But if for some reason it fails, i like it to restart.
As especially those moments are interesting times.

4

This is more of a Linux problem than a elasticsearch one. I did something like this for my elasticsearch service But I did it in a CentOS machine. Follow this guide. Pay attention to the Restart=on-failure part.

5

I dont know if this is bad ,but i dont have

 /etc/systemd/system/filebeat.service

I installed it as follows on debian10 :

sudo -i
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.10.1-amd64.deb
sudo dpkg -i filebeat-7.10.1-amd64.deb

filebeat modules enable system
filebeat setup -e          

systemctl status filebeat
systemctl enable filebeat
systemctl start filebeat
6

It's not. as I said before it might be on a different directory for your OS. unfortunately I don't have a Debian-based system to check that for you. But you could find it with a little bit of searching.

7

On the psotive side at least now it has survived several hard resets without config changes.
And if there truely would be something wrong with a real server its console check anyway.
For now i give this issue a bit of rest, got to work on other stuff.

If someone knows update the forum, or incase it gets closed (as i've seen with some other interesting question lacking solutions.. then pm me here.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.