Unable to create logrotated files in filebeat

Elastic Stack Beats
1 
config file:
    filebeat.prospectors:
    - type: log
      enabled: true
      paths:
        - /var/log/pcapcapture/packets.json
      document_type: "pcap_file"
      json.keys_under_root: true 
      fields: {log_type: capture}

    logging.level: info
    logging.metrics.enabled: true
    logging.to_files: true
    logging.files:
     path: /var/log/filebeat
     name: filebeat.log
     rotateeverybytes: 10485760 # = 10MB
     keepfiles: 7

i dont see any file created in /var/log/filebeat can anybody help me what i am missing
Thanks

2

How are you starting Filebeat? If you set -e (log to stderr) then it will not write a file.

Writing to /var/log/filebeat/filebeat is the default behavior. So if you don't set any logging.* options or set any CLI flags (like -e) then that's what it will do.

1 Like
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.