Upgrade from 7.6.2 to 7.7.0 stops filebeat logging to /var/log/filebeat on Debian 8

[fairfx (Gary Mason)]

I have used filebeat for nearly a year. Awesome product.

I have it running on a number of servers running Debian 7 and Debian 8. The upgrade to 7.7.0 I did this morning on Debian 7 worked exactly as expected, but on the Debian 8 machines, filebeat is no longer logging to /var/log/filebeat.

I have checked the systemd control file to remove the "-e" switch and that is all still in place. I can see the filebeat logs hitting journald though.

Have I missed something, or is there an issue with Debian 8 and the latest filebeat package and local logging ?

Thanks.

[kvch (Noémi Ványi)]

There was a little change in logging between those versions you are running. You should adjust the logging configuration in filebeat.yml:

logging.to_stderr: false

More context on the issue: https://github.com/elastic/beats/pull/15422

[fairfx (Gary Mason)]

Hi. Thanks for the quick response.

I checked my config and so far, I have always relied on default settings, as there is no explicit logging settings in filebeat.yml. I have made use of the systemd tweak though.

I can see this new setting in the reference yaml, but that suggests that the default is false, which should work for me, but it doesn't.

So I have now added all the logging settings I think I need to filebeat.yml. Restarting filebeat now gets me my local /var/log logging back. I am now a happy admin again. Many thanks for your advice.

For reference, my filebeat.yml file now includes the following:

logging.level: info
logging.to_stderr: false
logging.to_syslog: false
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  rotateeverybytes: 10485760 # = 10MB
  keepfiles: 7
  permissions: 0600
  rotateonstartup: true