Logging is important with any application/tool/software same way filebeat provide option for logging and it’s configuration.

Filebeat provide three ways of configuration for log output: syslog, file and stderr

Default Configuration :

Windows :  file output

Linux or others: syslog

Below are example of configuration for logging in file and syslog and how to run. You can also get Sample file for Logging Configuration at end of this blog.

Logging Configuration for output to file:

logging.level: debug
logging.selectors: ["*"]
logging.metrics.enabled: true
logging.to_files: true
logging.files:
path: /tmp
name: mybeat-app1.log
rotateeverybytes: 10485760
keepfiles: 8
level: debug

To start/run filebeat from command line use below command which will send output to logging files . For other option to run filebeat follow link Ways to run filebeat

./filebeat  -c filebeat.yml -d “publish”

Logging Configuration for output to syslog:

logging.level: debug
logging.selectors: ["*"]
logging.metrics.enabled: true
logging.to_syslog: true

To start/run filebeat from command line use below command which will send output to syslog .For other option to run filebeat follow link Ways to run filebeat

./filebeat -e -c filebeat.yml -d “publish”

Filebeat Logging Configuration in Detail :

• level :  Default log level is “info” . It can accept different log level like debug,info,warning,error or critical. If debug level is selected the no selectors configured by default consider as *.
• selectors[]: Filebeat provide different selectors “beat”,”publish”,”service” which will tell filebeat where these debugging need to apply. If need to configure all sectors can use [“*”].  We can also override selectors by using -d  command line option for setting debug level.
• to_syslog : By default to_syslog  is false which will send all output to sys_log.We can remove this flag from configuration file if need to configure for logging as file and set to_files as true and set other options for file.

Filebeat Performance analysis: We can enable metrics options if need analysis filebeat and what was change with previous interval.  It will record internally and will logged when filebeat will shotdown.

• matrics.enabled : default value is true.
• matrics.period: default value is 30s (Seconds) . Period of internal metrics log.

Filebeat Logging to`file: Will log all output to file. If not configure other fields for to files will take default values for below options.

• to_files : default value is true.
• path : set path of your directory where want to log files
• Name:  Default name generate as mybeat.log . if you want according to your application change name accordingly.
• Rotateeverybytes : Default Maximum size of log file is 10MB and if it will reach to max limit will generate new log file with rotation.
• keepfiles: Default value is 7 and accept value on range 2 to 1024 only.It will always keep  latest files in directory and delete older one while rotation.

Sample File for Logging Configuration

Sample filebeat.yml file for Logging Configuration

Integration

Complete Integration Example Filebeat, Kafka, Logstash, Elasticsearch and Kibana

Read More

To read more on Filebeat topics, sample configuration files and integration with other systems with example follow link Filebeat Tutorial  and  Filebeat Issues.To Know more about YAML follow link YAML Tutorials.

Leave you feedback to enhance more on this topic so that make it more helpful for others.