Start Filebeat [filebeat-starting]

Before starting Filebeat:

• Follow the steps in Quick start: installation and configuration to install, configure, and set up the Filebeat environment.
• Make sure {{kib}} and {{es}} are running.
• Make sure the user specified in filebeat.yml is authorized to publish events.

To start Filebeat, run:

:::::::{tab-set}

::::::{tab-item} DEB

sudo service filebeat start

::::{note} If you use an init.d script to start Filebeat, you can’t specify command line flags (see Command reference). To specify flags, start Filebeat in the foreground. ::::

Also see Filebeat and systemd. ::::::

::::::{tab-item} RPM

sudo service filebeat start

::::{note} If you use an init.d script to start Filebeat, you can’t specify command line flags (see Command reference). To specify flags, start Filebeat in the foreground. ::::

Also see Filebeat and systemd. ::::::

::::::{tab-item} MacOS

sudo chown root filebeat.yml <1>
sudo chown root modules.d/{modulename}.yml <1>
sudo ./filebeat -e

1. You’ll be running Filebeat as root, so you need to change ownership of the configuration file and any configurations enabled in the modules.d directory, or run Filebeat with --strict.perms=false specified. See Config File Ownership and Permissions. ::::::

::::::{tab-item} Linux

sudo chown root filebeat.yml <1>
sudo chown root modules.d/{modulename}.yml <1>
sudo ./filebeat -e

1. You’ll be running Filebeat as root, so you need to change ownership of the configuration file and any configurations enabled in the modules.d directory, or run Filebeat with --strict.perms=false specified. See Config File Ownership and Permissions. ::::::

::::::{tab-item} Windows

PS C:\Program Files\filebeat> Start-Service filebeat

By default Windows log files are stored in C:\Program Files\Filebeat-Data\logs.

:::{note} In versions before 9.0.6, the default location for Windows log files was C:\ProgramData\filebeat\logs. ::: ::::::

:::::::