Should I run filebeat from bin or etc?

Elastic Stack Beats
1

I did an rpm install of filebeat. When I run filebeat from /usr/bin/filebeat with /usr/bin/filebeat start or /usr/bin/filebeat -c /path/to/filebeat.yml, the shell just hangs. When I run etc/init.d/filebeat start, i get a message saying that it started.

However, if I use /etc/init.d/filebeat start, i can't pass command line arguments, such as the location of the config file. even /etc/init.d/filebeat -h does not work.

How should I run filebeat, with /usr/bin/filebeat or /etc/init.d/filebeat start?

2

If you run /usr/bin/filebeat you'll be starting Filebeat in the foreground, which typically isn't what you want since it'll shut down when you close your shell. The other option starts Filebeat as a daemon with options passed according to the init script. What's of most interest to you is that it'll use /etc/filebeat/filebeat.yml as its configuration file.

This is basic Unix/Linux skills and you will save yourself a lot of time by consulting a good book on the subject.

3

got it, thanks