Override logging.level in a Fleet managed Filebeat?

I have a Fleet managed Elastic Agent running as a service which on systemctl start elastic-agent starts-up filebeat with some flags(as seen in the picture).


I've tried to edit the filebeat.yml file and setting the logging.level: debug there but I don't think that would take precedence over something that is passed as a command line parameter.

Any help is appreciated...

[EDIT]: Reading up here - https://www.elastic.co/guide/en/fleet/8.5/beats-agent-comparison.html#supported-configurations. Does this mean anything in this context??

Hi @Akash_Deep
Welcome to the community!

Which integration are you using (custom logs?) and what version of the stack?

Logging levels should be supported per the docs you linked.

Also curious what you are trying to solve by increasing the log level.

Please keep the CAPS to a minimum.

If Custom Logs integration

Advanced Settings -> Custom Configurations

Hey @stephenb , thanks for your time.

Yes, I am using the custom logs integration with the stack (ver. 8.5.0).

I am trying to debug something that's been failing on Filebeat, hence trying to set the logging level to debug.(See screenshot)

I've tried the steps you mentioned about editing the custom configurations but no luck.

My understanding is that the custom configuration won't override something that has been passed as a command line argument while starting up.

Would like to know your thoughts or any other ways I might be able to debug the error I'm getting.


Please don't post images of text, please post formatted text. Images are hard to read and impossible to debug and help. Also, I would have included the few lines following that.

Yeah... I was thinking of something else and those custom parameters are at the input level

See Here

Thanks @stephenb , you're a savior.

That log-level change dropdown at the bottom never came in sight!

And thanks for the suggestions on writing better community posts. Appreciate it :+1:

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.