In this article, we will walk you through the process of troubleshooting the Filebeat agent. Let's dive in and get your Filebeat back up and running!

The first thing to do is ensure that your Filebeat configuration is set up correctly. Filebeat uses a configuration file to determine which logs to collect and where to send them. To access the configuration file, follow these steps:

1. Open the Filebeat installation directory.

2. Look for the file named filebeat.yml, this is typically found at /etc/filebeat/filebeat.yml

3. Once you have the configuration file open, look for the following settings:
​filebeat.inputs & output.logstash

- filebeat.inputs: This section specifies the logs you want to collect. Make sure the paths and patterns are correct for the logs you want to monitor. Only the below log files/paths are monitored by default:

- /var/log/*.log

- /var/log/audit/audit.log

- /var/log/messages

- /var/log/secure

- /var/log/logstash/logstash-plain.log

Additional logs can be added under the Filebeat Bulletproof Configuration section of filebeat.yml. Each entry should be on a new line and be formatted the same as the existing logs.

- output.logstash: This section defines where Filebeat should send the logs. Find the output.logstash section of the file and change the below line, replacing localhost with the IP address of your collector: hosts: ["localhost:5044"]

Next, let's check if the Filebeat service is running properly:

1. Open the terminal on your device.

2. Run the following command to check the status of the Filebeat service:
​sudo systemctl status filebeat

3. If the service is running, you should see a message indicating that it is active. If not, you can start the service using the following command:
​sudo systemctl start filebeat

Filebeat itself generates logs that can provide valuable information about any issues it encounters:

1. Open the Filebeat installation directory: /etc/filebeat

2. Look for the file named filebeat.log and open it using a text editor.

In the log file, look for any error messages or warnings that might indicate the cause of the logging issue. If you need assistance interpreting the log file, don't hesitate to reach out to our support team.