Override configuration settings at the command line

If you’re running Filebeat as a service, you can’t specify command-line flags. To specify flags, start Filebeat in the foreground.

You can override any configuration setting from the command line by using flags:

-E, --E "SETTING_NAME=VALUE": Overrides a specific configuration setting.
-M, --M "VAR_NAME=VALUE": Overrides the default configuration for a module.

You can specify multiple overrides. Overrides are applied to the currently running Filebeat process. The Filebeat configuration file is not changed.

Example: override configuration file settings

edit

The following configuration sends logging output to files:

logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0640

To override the logging level and send logging output to standard error instead of a file, use the -E flag when you run Filebeat:

-E "logging.to_files=false" -E "logging.to_stderr=true" -E "logging.level=error"

Example: override module settings

edit

The following configuration sets the path to Nginx access logs:

- module: nginx
  access:
    var.paths: ["/var/log/nginx/access.log*"]

To override this setting from the command line, use the -M flag when you run Filebeat. The variable name must include the module and fileset name. For example:

-M "nginx.access.var.paths=[/path/to/log/nginx/access.log*]"

You can specify multiple overrides. Each override must start with -M.

For information about specific variables that you can set for each fileset, see the documentation under Modules.

« How to guides Load the Elasticsearch index template »