- Auditbeat Reference: other versions:
- Auditbeat overview
- Quick start: installation and configuration
- Set up and run
- Upgrade Auditbeat
- Configure
- Modules
- General settings
- Project paths
- Config file reloading
- Output
- Kerberos
- SSL
- Index lifecycle management (ILM)
- Elasticsearch index template
- Kibana endpoint
- Kibana dashboards
- Processors
- Define processors
- add_cloud_metadata
- add_cloudfoundry_metadata
- add_docker_metadata
- add_fields
- add_host_metadata
- add_id
- add_kubernetes_metadata
- add_labels
- add_locale
- add_network_direction
- add_nomad_metadata
- add_observer_metadata
- add_process_metadata
- add_session_metadata
- add_tags
- append
- community_id
- convert
- copy_fields
- decode_base64_field
- decode_duration
- decode_json_fields
- decode_xml
- decode_xml_wineventlog
- decompress_gzip_field
- detect_mime_type
- dissect
- dns
- drop_event
- drop_fields
- extract_array
- fingerprint
- include_fields
- move_fields
- rate_limit
- registered_domain
- rename
- replace
- syslog
- translate_ldap_attribute
- translate_sid
- truncate_fields
- urldecode
- Internal queue
- Logging
- HTTP endpoint
- Regular expression support
- Instrumentation
- Feature flags
- auditbeat.reference.yml
- How to guides
- Modules
- Exported fields
- Monitor
- Secure
- Troubleshoot
- Get Help
- Debug
- Understand logged metrics
- Common problems
- Auditbeat fails to watch folders because too many files are open
- Auditbeat uses too much bandwidth
- Error loading config file
- Found unexpected or unknown characters
- Logstash connection doesn’t work
- Publishing to Logstash fails with "connection reset by peer" message
- @metadata is missing in Logstash
- Not sure whether to use Logstash or Beats
- SSL client fails to connect to Logstash
- Monitoring UI shows fewer Beats than expected
- Dashboard could not locate the index-pattern
- High RSS memory usage due to MADV settings
- Contribute to Beats
Start Auditbeat
editStart Auditbeat
editBefore starting Auditbeat:
- Follow the steps in Quick start: installation and configuration to install, configure, and set up the Auditbeat environment.
- Make sure Kibana and Elasticsearch are running.
-
Make sure the user specified in
auditbeat.yml
is authorized to publish events.
To start Auditbeat, run:
sudo service auditbeat start
If you use an init.d
script to start Auditbeat, you can’t specify command
line flags (see Command reference). To specify flags, start Auditbeat in
the foreground.
Also see Auditbeat and systemd.
sudo service auditbeat start
If you use an init.d
script to start Auditbeat, you can’t specify command
line flags (see Command reference). To specify flags, start Auditbeat in
the foreground.
Also see Auditbeat and systemd.
You’ll be running Auditbeat as root, so you need to change ownership
of the configuration file, or run Auditbeat with |
You’ll be running Auditbeat as root, so you need to change ownership
of the configuration file, or run Auditbeat with |
PS C:\Program Files\auditbeat> Start-Service auditbeat
By default, Windows log files are stored in C:\ProgramData\auditbeat\Logs
.