Skip to content
Permalink
Browse files

Add note about systemd + filebeat 7.x logging issue

  • Loading branch information...
watsonian committed Jun 4, 2019
1 parent 316b5a3 commit 135435a5597d9a8a1199341da8bcd1edce119fe0
Showing with 26 additions and 3 deletions.
  1. +26 −3 content/integrations/data-shippers/beats/filebeat.md
@@ -33,11 +33,10 @@ Check out Filebeat's [official documentation](https://www.elastic.co/guide/en/be

## Installation

To download Filebeat, visit the [Filebeat OSS downloads page](https://www.elastic.co/downloads/beats/filebeat-oss)
To download Filebeat, visit the [Filebeat OSS downloads page](https://www.elastic.co/downloads/beats/filebeat-oss). You can find installation documentation for Filebeat at [the Filebeat Installation page of the official Filebeat website](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html).

{{% notice note %}}
***Installation documentation***
You can find installation documentation for Filebeat at [the Filebeat Installation page of the official Filebeat website](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html).
For Filebeat OSS 7.x+, you need to be running Humio 1.5.8 or higher.
{{% /notice %}}

## Configuration
@@ -107,6 +106,30 @@ You must make the following changes to the sample configuration:

An important next step is [choosing a parser for your filebeat events]({{< relref "filebeat.md#parsing-data" >}}).

## Enabling debug logging

When setting up Filebeat, it's helpful to see what's going on under the hood. To do that, you need to enable
debug logging. Add this to the end of your `filebeat.yml` config file:

```yaml
logging:
level: debug
to_files: true
to_syslog: false
files:
path: /var/log/filebeat
name: filebeat.log
keepfiles: 3
```

{{% notice warning %}}
If you're using Filebeat with systemd, more recent versions execute Filebeat with the `-e` flag
by default. This will cause Filebeat to ignore many of these logging options. Notably, it will
log to `/var/log/messages` regardless of what you've specified here. To fix this, you should remove
`Environment="BEAT_LOG_OPTS=-e"` from Filebeats' systemd unit file. See
[this GitHub issue](https://github.com/elastic/beats/issues/12024) for more details.
{{% /notice %}}

## Running Filebeat {#running-filebeat}

Run Filebeat as a service on Linux with the following commands

0 comments on commit 135435a

Please sign in to comment.
You can’t perform that action at this time.