WARNING: Version 5.4 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Filebeat Global
editFilebeat Global
editYou can specify configuration options in the filebeat.yml config file to control Filebeat behavior at a global level.
Options
editspool_size
editThe event count spool threshold. This setting forces a network flush if the number of events in the spooler exceeds the specified value.
filebeat.spool_size: 2048
See Load Balancing for more information about how this setting affects load balancing.
publish_async
editThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Deprecated in 5.3.0.
If enabled, the publisher pipeline in Filebeat operates in async mode preparing a new batch of lines while waiting for ACK. This option can improve load-balancing throughput at the cost of increased memory usage. The default value is false.
See Load Balancing for more information about how this setting affects load balancing.
idle_timeout
editA duration string that specifies how often the spooler is flushed. After the
idle_timeout is reached, the spooler is flushed even if the spool_size has not been reached.
filebeat.idle_timeout: 5s
registry_file
editThe name of the registry file. If a relative path is used, it is considered relative to the
data path. See the Directory Layout section for details. The default is ${path.data}/registry.
filebeat.registry_file: registry
It is not possible to use a symlink as registry file.
The registry file is only updated when new events are flushed and not on a predefined period. That means in case there are some states where the TTL expired, these are only removed when new event are processed.
config_dir
editThe full path to the directory that contains additional prospector configuration files.
Each configuration file must end with .yml. Each config file must also specify the full Filebeat
config hierarchy even though only the prospector part of the file is processed. All global
options, such as spool_size, are ignored.
The config_dir option MUST point to a directory other than the directory where the main Filebeat config file resides.
If the specified path is not absolute, it is considered relative to the configuration path. See the Directory Layout section for details.
filebeat.config_dir: path/to/configs
shutdown_timeout
editHow long Filebeat waits on shutdown for the publisher to finish sending events before Filebeat shuts down.
By default, this option is disabled, and Filebeat does not wait for the publisher to finish sending events before shutting down. This means that any events sent to the output, but not acknowledged before Filebeat shuts down, are sent again when you restart Filebeat. For more details about how this works, see How Does Filebeat Ensure At-Least-Once Delivery?.
You can configure the shutdown_timeout option to specify the maximum amount
of time that Filebeat waits for the publisher to finish sending events before
shutting down. If all events are acknowledged before shutdown_timeout is
reached, Filebeat will shut down.
There is no recommended setting for this option because determining the correct
value for shutdown_timeout depends heavily on the environment in which
Filebeat is running and the current state of the output.
Example configuration:
filebeat.shutdown_timeout: 5s