filebeat

Start filebeat with default configuration

$ filebeat

$ filebeat -c [path/to/filebeat.yml]

$ filebeat test config

$ filebeat test output

$ filebeat modules enable [nginx]

$ filebeat modules list

$ filebeat setup

$ filebeat --once

filebeat [COMMAND] [FLAGS]

Filebeat is a lightweight log shipper from the Elastic Stack (ELK). It monitors log files, collects log events, and forwards them to Elasticsearch, Logstash, or other outputs for indexing and analysis.
Filebeat uses harvesters to read log files line by line and sends the data to configured outputs. It maintains state information to track read positions, ensuring reliable delivery even after restarts. Modules provide pre-built configurations for common applications like nginx, Apache, MySQL, and system logs.
Configuration is defined in filebeat.yml, specifying inputs (log paths), outputs (Elasticsearch/Logstash endpoints), and processing options.

-c FILE

Specify configuration file (default: filebeat.yml).

Log to stderr instead of syslog/file.

Comma-separated list of modules to run.

Run harvesters once and exit when done.

Path to configuration files.

Path to data directory.

Path to log files.

Enforce strict permission checking on config files (default: true).

Enable verbose logging.

Enable debug output for specific components.

run

Run Filebeat (default command if none specified).

Test configuration file syntax.

Test connectivity to configured outputs.

Enable one or more modules.

Disable one or more modules.

List available and enabled modules.

Set up index templates, dashboards, and pipelines.

Export current configuration to stdout.

Export index template to stdout.

Export a Kibana dashboard to stdout.

Configuration files require strict permissions (owner read/write only) by default. When running via systemd, the -e flag may override logging settings. Modules must be enabled before use. Index templates and dashboards require Elasticsearch and Kibana connectivity during setup.

Filebeat is part of the Beats family of lightweight data shippers developed by Elastic. It evolved from Logstash Forwarder (Lumberjack) to provide a more resource-efficient solution for log collection. The Beats platform was introduced around 2015, with Filebeat becoming the primary choice for log shipping in the Elastic Stack.

metricbeat(1), logstash(1), elasticsearch(1), journalctl(1)