#FILEBEATS SETTINGS INSTALL#

When Filebeat is restarted, data from the registry file is used to rebuild the state, and Filebeat continues each harvester at the last known position.įor each input, Filebeat keeps a state of each file it finds. While Filebeat is running, the state information is also kept in memory for each input. If the output, such as Elasticsearch or Logstash, is not reachable, Filebeat keeps track of the last lines sent and will continue reading the files as soon as the output becomes available again. The state is used to remember the last offset a harvester was reading from and to ensure all log lines are sent. How does Filebeat keep the state of files? editįilebeat keeps the state of each file and frequently flushes the state to disk in the registry file. New lines are only picked up if the size of the file has changed since the harvester was closed. The log input checks each file to see whether a harvester needs to be started, whether one is already running, or whether the file can be ignored (see ignore_older). Each input type can be defined multiple times. By default, Filebeat keeps the file open until close_inactive is reached.Ĭlosing a harvester has the following consequences:įilebeat currently supports several input types. This has the side effect that the space on your disk is reserved until the harvester closes. If a file is removed or renamed while it’s being harvested, Filebeat continues to read the file. The harvester is responsible for opening and closing the file, which means that the file descriptor remains open while the harvester is running.

The harvester reads each file, line by line, and sends the content to the output. What is a harvester? editĪ harvester is responsible for reading the content of a single file. These components work together to tail files and send event data to the output that you specify. Understanding these concepts will help you make informed decisions about configuring Filebeat for specific use cases.įilebeat consists of two main components: inputs and harvesters. You can increase verbosity by setting logging.level: debug in your config file.In this topic, you learn about the key building blocks of Filebeat and how they work together. The logs are located at /var/log/filebeat/filebeat by default on Linux. usr/share/filebeat/scripts/import_dashboards -es You can check if data is contained in a filebeat-YYYY.MM.dd index in Elasticsearch using a curl command that will print the event count.Ĭurl And you can check the Filebeat logs for errors if you have no events in Elasticsearch. This is for Linux when installed via RPM or deb. The path to the import_dashboards script may vary based on how you installed Filebeat.

#FILEBEATS SETTINGS INSTALL#

Alternatively you could run the import_dashboards script provided with Filebeat and it will install an index pattern into Kibana for you. So in Kibana you should configure a time based index pattern based on the filebeat-* index pattern instead of logstash-*. It uses the filebeat-* index instead of the logstash-* index so that it can use its own index template and have exclusive control over the data in that index.

If you followed the official Filebeat getting started guide and are routing data from Filebeat -> Logstash -> Elasticearch, then the data produced by Filebeat is supposed to be contained in a filebeat-YYYY.MM.dd index.

Filebeats settings