# Running beats service logs are overwritten

**URL:** <https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019>\
**Category:** Beats\
**Created:** [April 22, 2018, 7:17pm UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019 "2018-04-22T19:17:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![localghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/localghost/32/30337_2.png) [@localghost](https://discuss.elastic.co/u/localghost)\
**Post date:** [April 22, 2018, 7:17pm UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019/1 "2018-04-22T19:17:52Z")

</div>

I have a running metricbeat service with logging configured to default destination - /var/log/metricbeat/metricbeat. The issue is that when I run some beats command like metricbeat modules list metricbeat's log file gets overwritten by the logs of recently executed command and service though still working does not log anything anymore. The problem is resolved when I restart the service but I would prefer to avoid that if possible.  
Am I doing something wrong or is it a known issue with beats (the same is with filebeat) which can be workaround somehow?

ELK version: 6.2.3

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [April 23, 2018, 4:26pm UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019/2 "2018-04-23T16:26:10Z")

</div>

Hello @localghost, Yes this is the default behavior, but if you run the command with the flag `-e` it will log to `stderr` and `stdout`.

---

<div class="post-metadata">

**Author:** ![localghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/localghost/32/30337_2.png) [@localghost](https://discuss.elastic.co/u/localghost)\
**Post date:** [April 24, 2018, 6:10am UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019/3 "2018-04-24T06:10:02Z")

</div>

Hi @pierhugues, thank for the tip.

But if that's the default behaviour, as you have said, then I would consider this to be a bug that in default setup and pretty standard use case the log file of a running service gets corrupted. What's more, since it's happening without any warning, the problem might pass unnoticed until much later when there is an actual need to check service logs.

Should I submit a ticket in beats issue tracker then?

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [April 25, 2018, 2:48pm UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019/4 "2018-04-25T14:48:08Z")

</div>

I will bring it to the team and check if we do a followup issue, thanks @localghost

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2018, 4:48pm UTC](https://discuss.elastic.co/t/running-beats-service-logs-are-overwritten/129019/5 "2018-05-23T16:48:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.