Start Packetbeat [packetbeat-starting]

Before starting Packetbeat:

• Follow the steps in Quick start: installation and configuration to install, configure, and set up the Packetbeat environment.
• Make sure {{kib}} and {{es}} are running.
• Make sure the user specified in packetbeat.yml is authorized to publish events.

To start Packetbeat, run:

:::::::{tab-set}

::::::{tab-item} DEB

sudo service packetbeat start

::::{note} If you use an init.d script to start Packetbeat, you can’t specify command line flags (see Command reference). To specify flags, start Packetbeat in the foreground. ::::

Also see Packetbeat and systemd. ::::::

::::::{tab-item} RPM

sudo service packetbeat start

::::{note} If you use an init.d script to start Packetbeat, you can’t specify command line flags (see Command reference). To specify flags, start Packetbeat in the foreground. ::::

Also see Packetbeat and systemd. ::::::

::::::{tab-item} MacOS

sudo chown root packetbeat.yml <1>
sudo ./packetbeat -e

1. You’ll be running Packetbeat as root, so you need to change ownership of the configuration file, or run Packetbeat with --strict.perms=false specified. See Config File Ownership and Permissions. ::::::

::::::{tab-item} Linux

sudo chown root packetbeat.yml <1>
sudo ./packetbeat -e

1. You’ll be running Packetbeat as root, so you need to change ownership of the configuration file, or run Packetbeat with --strict.perms=false specified. See Config File Ownership and Permissions. ::::::

::::::{tab-item} Windows

PS C:\Program Files\packetbeat> Start-Service packetbeat

By default Windows log files are stored in C:\Program Files\Packetbeat-Data\logs.

:::{note} In versions before 9.0.6, the default location for Windows log files was C:\ProgramData\packetbeat\logs. ::: ::::::

:::::::