Command Line Options

edit

Winlogbeat does not have any Winlogbeat-specific command line options. Instead, you configure the behavior of Winlogbeat by specifying options in the configuration file.

The following command line options from libbeat are also available for Winlogbeat.

Run winlogbeat -h to see the full list of options from the command line.

-E <setting>=<value>

Overwrite an individual setting in the config file. For example:

sudo ./winlogbeat -c winlogbeat.yml -E name=mybeat
-N
Disable the publishing of events to the defined output. This option is useful only for testing the Beat.
-c <file>
Pass the location of a configuration file for the Beat.
-configtest
Test the configuration file and then exit. This option is useful for troubleshooting the configuration of a Beat.
-cpuprofile <output file>
Write CPU profile data to the specified file. This option is useful for troubleshooting the Beat.
-d <selectors>
Enable debugging for the specified selectors. For the selectors, you can specify a comma-separated list of components, or you can use -d "*" to enable debugging for all components. For example, -d "publish" displays all the "publish" related messages.
-e
Log to stderr and disable syslog/file output.
-httpprof [<host>]:<port>
Start http server for profiling. This option is useful for troubleshooting and profiling the Beat.
-memprofile <output file>
Write memory profile data to the specified output file. This option is useful for troubleshooting the Beat.
-path.config
Set the default location for configuration (e.g. the Elasticsearch template). See the Directory Layout section for details.
-path.data
Set the default location for data files. See the Directory Layout section for details.
-path.home
Set the default location for miscellaneous files. See the Directory Layout section for details.
-path.logs
Set the default location for log files. See the Directory Layout section for details.
-v
Enable verbose output to show INFO-level messages.
-version
Display the Beat version and exit.