Overriding output from command line

Elastic Stack Beats
1

I'd like to debug processing of events by production filebeat.yml trying to redirect input and output for filebeat to console. Input can be redefined by -E with no problems but output redirection is fairly impossible.

Assuming filebeat.yml like

... 
output: logstash.hosts: [ 'host:port' ] 
...

if we run

filebeat -E 'output={console:{pretty:true}}'

we encounter error about 'more than one output'. In my opinion this -E should override whole definition of output, but seems only merge to one in .yml file. Is this bug in -E application? Is there any other possibility of redirection of output with no modification to original .yml file

2

You also need to disable the output defined in your config. Try:

filebeat -E output.logstash.enabled=false -E 'output={console:{pretty:true}}'

This is expected behavior, not a bug.

3

In my opinion, for sure, this is not bug related to 'output' behavior, but maybe bug to overriding the config. One could think that -E path={object def} should redefine whole config object pointed by path (i.e. deleting other props defined in .yml), and not only append {object def} to it. For some configurations this could be crucial.

4

I was going to suggest that you open an enhancement request, but I see you've already done that. Thank you!