# Upgrade from 7.6.2 to 7.7.0 stops filebeat logging to /var/log/filebeat on Debian 8

**URL:** <https://discuss.elastic.co/t/upgrade-from-7-6-2-to-7-7-0-stops-filebeat-logging-to-var-log-filebeat-on-debian-8/235349>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 2, 2020, 1:26pm UTC](https://discuss.elastic.co/t/upgrade-from-7-6-2-to-7-7-0-stops-filebeat-logging-to-var-log-filebeat-on-debian-8/235349 "2020-06-02T13:26:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![fairfx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fairfx/32/69572_2.png) [@fairfx](https://discuss.elastic.co/u/fairfx)\
**Post date:** [June 2, 2020, 1:26pm UTC](https://discuss.elastic.co/t/upgrade-from-7-6-2-to-7-7-0-stops-filebeat-logging-to-var-log-filebeat-on-debian-8/235349/1 "2020-06-02T13:26:15Z")

</div>

I have used filebeat for nearly a year. Awesome product.

I have it running on a number of servers running Debian 7 and Debian 8. The upgrade to 7.7.0 I did this morning on Debian 7 worked exactly as expected, but on the Debian 8 machines, filebeat is no longer logging to /var/log/filebeat.

I have checked the systemd control file to remove the "-e" switch and that is all still in place. I can see the filebeat logs hitting journald though.

Have I missed something, or is there an issue with Debian 8 and the latest filebeat package and local logging ?

Thanks.

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [June 2, 2020, 4:29pm UTC](https://discuss.elastic.co/t/upgrade-from-7-6-2-to-7-7-0-stops-filebeat-logging-to-var-log-filebeat-on-debian-8/235349/2 "2020-06-02T16:29:33Z")

</div>

There was a little change in logging between those versions you are running. You should adjust the logging configuration in `filebeat.yml`:

```auto
logging.to_stderr: false

```

More context on the issue: [https://github.com/elastic/beats/pull/15422](https://github.com/elastic/beats/pull/15422)

---

<div class="post-metadata">

**Author:** ![fairfx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fairfx/32/69572_2.png) [@fairfx](https://discuss.elastic.co/u/fairfx)\
**Post date:** [June 3, 2020, 1:28pm UTC](https://discuss.elastic.co/t/upgrade-from-7-6-2-to-7-7-0-stops-filebeat-logging-to-var-log-filebeat-on-debian-8/235349/3 "2020-06-03T13:28:34Z")

</div>

Hi. Thanks for the quick response.

I checked my config and so far, I have always relied on default settings, as there is no explicit logging settings in filebeat.yml. I have made use of the systemd tweak though.

I can see this new setting in the reference yaml, but that suggests that the default is false, which should work for me, but it doesn't.

So I have now added all the logging settings I think I need to filebeat.yml. Restarting filebeat now gets me my local /var/log logging back. I am now a happy admin again. Many thanks for your advice.

For reference, my filebeat.yml file now includes the following:

```
logging.level: info
logging.to_stderr: false
logging.to_syslog: false
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  rotateeverybytes: 10485760 # = 10MB
  keepfiles: 7
  permissions: 0600
  rotateonstartup: true
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 1, 2020, 1:28pm UTC](https://discuss.elastic.co/t/upgrade-from-7-6-2-to-7-7-0-stops-filebeat-logging-to-var-log-filebeat-on-debian-8/235349/4 "2020-07-01T13:28:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.