Search code examples
filebeat

Filebeat not logging to files, always only to syslog


My filebeat (v7.6.0) config has the following:

logging.level: debug
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0755

It doesn't create the files, nor does it log to them, it just continues to log to syslog instead.

What haven't I done/have I done wrong?


Solution

  • According to the docs:

    When Filebeat is running on a Linux system with systemd, it uses by default the -e command line option, that makes it write all the logging output to stderr so it can be captured by journald. Other outputs are disabled.