[WARNING] When Filebeat is running on a Linux system with systemd, it uses by default the -e command line option, that makes it write all the logging output to stderr so it can be captured by journald. Other outputs are disabled.
Filebeat and systemd and Customize systemd unit for Filebeat
To change the logging output from the Filebeat configuration file, empty the environment variable.
[Service]
Environment="BEAT_LOG_OPTS="
then
systemctl daemon-reload
systemctl restart filebeat
I first use systemctl edit filebeat.service
to edit, but it not works.
$ ls /etc/systemd/system/filebeat.service.d/
override.conf
I just rename the override.conf to debug.conf with mv override.conf debug.conf
, then reload and restart, it works.
$ tail -f /var/log/filebeat/filebeat
2019-08-23T18:22:02.620+0800 INFO [monitoring] log/log.go:145 Non-zero metrics in the last 30s