- Filebeat Reference: other versions:
- Overview
- Getting Started With Filebeat
- Step 1: Install Filebeat
- Step 2: Configure Filebeat
- Step 3: Configure Filebeat to use Logstash
- Step 4: Load the index template in Elasticsearch
- Step 5: Set up the Kibana dashboards
- Step 6: Start Filebeat
- Step 7: View the sample Kibana dashboards
- Quick start: modules for common log formats
- Repositories for APT and YUM
- Setting up and running Filebeat
- Upgrading Filebeat
- How Filebeat works
- Configuring Filebeat
- Specify which modules to run
- Configure inputs
- Manage multiline messages
- Specify general settings
- Load external configuration files
- Configure the internal queue
- Configure the output
- Load balance the output hosts
- Specify SSL settings
- Filter and enhance the exported data
- Parse data by using ingest node
- Set up project paths
- Set up the Kibana endpoint
- Load the Kibana dashboards
- Load the Elasticsearch index template
- Configure logging
- Use environment variables in the configuration
- Autodiscover
- YAML tips and gotchas
- Regular expression support
- HTTP Endpoint
- filebeat.reference.yml
- Beats central management
- Modules
- Exported fields
- Apache2 fields
- Auditd fields
- Beat fields
- Cloud provider metadata fields
- Docker fields
- elasticsearch fields
- haproxy fields
- Host fields
- Icinga fields
- IIS fields
- Kafka fields
- kibana fields
- Kubernetes fields
- Log file content fields
- logstash fields
- mongodb fields
- MySQL fields
- Nginx fields
- Osquery fields
- PostgreSQL fields
- Redis fields
- System fields
- Traefik fields
- Monitoring Filebeat
- Securing Filebeat
- Troubleshooting
- Migrating from Logstash Forwarder to Filebeat
- Contributing to Beats
Configure logging
editConfigure logging
editThe logging
section of the filebeat.yml
config file contains options
for configuring the logging output.
The logging system can write logs to the syslog or rotate log files. If logging
is not explicitly configured the file output is used.
logging.level: info logging.to_files: true logging.files: path: /var/log/filebeat name: filebeat keepfiles: 7 permissions: 0644
In addition to setting logging options in the config file, you can modify the logging output configuration from the command line. See Command reference.
Configuration options
editYou can specify the following options in the logging
section of the
filebeat.yml
config file:
logging.to_syslog
editWhen true, writes all logging output to the syslog.
This option is not supported on Windows.
logging.to_eventlog
editWhen true, writes all logging output to the Windows Event Log.
logging.to_files
editWhen true, writes all logging output to files. The log files are automatically rotated when the log file size limit is reached.
Filebeat only creates a log file if there is logging output. For
example, if you set the log level
to error
and there are no
errors, there will be no log file in the directory specified for logs.
logging.level
editMinimum log level. One of debug
, info
, warning
, or error
. The default
log level is info
.
-
debug
-
Logs debug messages, including a detailed printout of all events
flushed. Also logs informational messages, warnings, errors, and
critical errors. When the log level is
debug
, you can specify a list ofselectors
to display debug messages for specific components. If no selectors are specified, the*
selector is used to display debug messages for all components. -
info
- Logs informational messages, including the number of events that are published. Also logs any warnings, errors, or critical errors.
-
warning
- Logs warnings, errors, and critical errors.
-
error
- Logs errors and critical errors.
logging.selectors
editThe list of debugging-only selector tags used by different Filebeat components.
Use *
to enable debug output for all components. For example add publish
to display
all the debug messages related to event publishing.
When starting filebeat, selectors can be overwritten using the -d
command
line option (-d
also sets the debug log level).
logging.metrics.enabled
editIf enabled, Filebeat periodically logs its internal metrics that have changed in the last period. For each metric that changed, the delta from the value at the beginning of the period is logged. Also, the total values for all non-zero internal metrics are logged on shutdown. The default is true.
Here is an example log line:
2017-12-17T19:17:42.667-0500 INFO [metrics] log/log.go:110 Non-zero metrics in the last 30s: beat.info.uptime.ms=30004 beat.memstats.gc_next=5046416
Note that we currently offer no backwards compatible guarantees for the internal metrics and for this reason they are also not documented.
logging.metrics.period
editThe period after which to log the internal metrics. The default is 30s.
logging.files.path
editThe directory that log files are written to. The default is the logs path. See the Directory layout section for details.
logging.files.name
editThe name of the file that logs are written to. The default is filebeat.
logging.files.rotateeverybytes
editThe maximum size of a log file. If the limit is reached, a new log file is generated. The default size limit is 10485760 (10 MB).
logging.files.keepfiles
editThe number of most recent rotated log files to keep on disk. Older files are
deleted during log rotation. The default value is 7. The keepfiles
options has
to be in the range of 2 to 1024 files.
logging.files.permissions
editThe permissions mask to apply when rotating log files. The default value is
0600. The permissions
option must be a valid Unix-style file permissions mask
expressed in octal notation. In Go, numbers in octal notation must start with
0.
Examples:
- 0644: give read and write access to the file owner, and read access to all others.
- 0600: give read and write access to the file owner, and no access to all others.
- 0664: give read and write access to the file owner and members of the group associated with the file, as well as read access to all other users.
logging.files.interval
editEnable log file rotation on time intervals in addition to size-based rotation. Intervals must be at least 1s. Values of 1m, 1h, 24h, 7*24h, 30*24h, and 365*24h are boundary-aligned with minutes, hours, days, weeks, months, and years as reported by the local system clock. All other intervals are calculated from the unix epoch. Defaults to disabled.
logging.json
editWhen true, logs messages in JSON format. The default is false.
Logging format
editThe logging format is generally the same for each logging output. The one exception is with the syslog output where the timestamp is not included in the message because syslog adds its own timestamp.
Each log message consists of the following parts:
- Timestamp in ISO8601 format
- Level
- Logger name contained in brackets (Optional)
- File name and line number of the caller
- Message
- Structured data encoded in JSON (Optional)
Below are some samples:
2017-12-17T18:54:16.241-0500 INFO logp/core_test.go:13 unnamed global logger
2017-12-17T18:54:16.242-0500 INFO [example] logp/core_test.go:16 some message
2017-12-17T18:54:16.242-0500 INFO [example] logp/core_test.go:19 some message {"x": 1}
On this page
- Configuration options
logging.to_syslog
logging.to_eventlog
logging.to_files
logging.level
logging.selectors
logging.metrics.enabled
logging.metrics.period
logging.files.path
logging.files.name
logging.files.rotateeverybytes
logging.files.keepfiles
logging.files.permissions
logging.files.interval
logging.json
- Logging format