WARNING: Version 1.2 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Logging
editLogging
editThe logging
section contains options for configuring the Beats logging output.
The logging system can write logs to syslog or rotate log files. If logging is
not explicitly configured, file output is used on Windows systems, and syslog
output is used on Linux and OS X.
logging: level: warning # enable file rotation with default configuration to_files: true # do not log to syslog to_syslog: false files: path: /var/log/mybeat name: mybeat.log keepfiles: 7
In addition to the logging system, the logging output configuration can be modified from the command line.
Logging Options
editYou can specify the following options under the logging
section:
to_syslog
editSends all logging output to syslog if enabled. For non-Windows systems, the default value is true.
to_files
editWrites all logging output to files subject to file rotation. On Windows systems, the default value is true.
level
editMinimum log level. One of debug, info, warning, error or critical. If debug is
used, but no selectors are configured, the *
selector will be used.
The default log level is error.
selectors
editThe list of debugging-only selector tags used by different Beats components. Use *
to enable debug output for all components. For example add publish
to display
all the debug messages related to event publishing. When starting the Beat,
selectors can be overwritten using the -d
command line option (-d
also sets
the debug log level).
files.path
editThe directory that log files are written to. For Windows
systems the default path is C:\ProgramData\<beat-name>\Logs
. The default for
non-Windows systems is /var/log/<beat-name>
.
files.name
editThe name of the file that logs are written to. By default, the name of the Beat is used.
files.rotateeverybytes
editThe maximum size of a log file. If the limit is reached, a new log file is generated. The default size limit is 10485760 (10 MB).
files.keepfiles
editThe number of most recent rotated log files to keep on disk. Older files are
deleted during log rotation. The default value is 7. The keepfiles
options has to be
in the range of 2 to 1024 files.
Logging Format
editThe logging format is different for each logging type:
- to syslog: Syslog adds the timestamp itself.
-
to file: RFC 3339 format is used for the timestamp:
2006-01-02T15:04:05Z07:00 WARN log-message
. The format includes the timezone followed by the logging level. -
to stderr: UTC format is used for the timestamp:
2015/11/12 09:03:37.369262 geolite.go:52: WARN log-message
. The format includes the UTC timestamp with the milliseconds, then the name of the caller that sent the log entry followed by the logging level. This option should be used mainly for debugging.