{"id":23835,"date":"2026-04-23T09:41:48","date_gmt":"2026-04-23T09:41:48","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=23835"},"modified":"2026-04-23T09:42:12","modified_gmt":"2026-04-23T09:42:12","slug":"how-to-install-configure-elastic-filebeats","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/how-to-install-configure-elastic-filebeats\/","title":{"rendered":"How to install &amp; configure Elastic Filebeat?"},"content":{"rendered":"\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"683\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-1-1024x683.png\" alt=\"\" class=\"wp-image-49239\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-1-1024x683.png 1024w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-1-300x200.png 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-1-768x512.png 768w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-1.png 1536w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Filebeat client is a lightweight, resource-friendly tool that collects logs from files on the server and forwards these logs to your Logstash instance for processing. Filebeat is designed for reliability and low latency. Filebeat has a light resource footprint on the host machine, and the Beats input plugin minimizes the resource demands on the Logstash instance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisite<\/h2>\n\n\n\n<p>To get started, go here to download the sample data set used in this example. Unpack the file.<br>$ wget https:\/\/download.elastic.co\/demos\/logstash\/gettingstarted\/logstash-tutorial.log.gz<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1 &#8211; Download your preferred beat. e.g filebeat<\/h2>\n\n\n\n<p>Using &#8211; https:\/\/www.elastic.co\/downloads\/beats\/<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Install a filebeat 7.x<\/h2>\n\n\n\n<p>Using &#8211; https:\/\/www.elastic.co\/downloads\/beats\/filebeat<\/p>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-1\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">$ sudo yum install wget -y\n$ wget https:<span class=\"hljs-comment\">\/\/artifacts.elastic.co\/downloads\/beats\/filebeat\/filebeat-7.15.0-linux-x86_64.tar.gz<\/span>\n$ tar -zxvf filebeat<span class=\"hljs-number\">-7.15<\/span><span class=\"hljs-number\">.0<\/span>-linux-x86_64.tar.gz\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-1\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h2 class=\"wp-block-heading\">Install a filebeat 9.0<\/h2>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-2\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">sudo -s\ncd\nwget https:<span class=\"hljs-comment\">\/\/artifacts.elastic.co\/downloads\/beats\/filebeat\/filebeat-9.0.0-linux-x86_64.tar.gz<\/span>\ntar -zxvf filebeat<span class=\"hljs-number\">-9.0<\/span><span class=\"hljs-number\">.0<\/span>-linux-x86_64.tar.gz\ncd filebeat<span class=\"hljs-number\">-9.0<\/span><span class=\"hljs-number\">.0<\/span>-linux-x86_64\nvi filebeat.yml\nsudo .\/filebeat -e -c filebeat.yml<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-2\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Install a filebeat 9.3<\/h2>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-3\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">$ cd\n$ wget https:<span class=\"hljs-comment\">\/\/artifacts.elastic.co\/downloads\/beats\/filebeat\/filebeat-9.3.3-linux-x86_64.tar.gz<\/span>\n$ tar -zxvf filebeat<span class=\"hljs-number\">-9.3<\/span><span class=\"hljs-number\">.3<\/span>-linux-x86_64.tar.gz \n$ mv filebeat<span class=\"hljs-number\">-9.3<\/span><span class=\"hljs-number\">.3<\/span>-linux-x86_64 filebeat\n$ cd filebeat\/\n$ vi filebeat.yml &#91; <span class=\"hljs-keyword\">AS<\/span> PER THE IMAGE BELOW ] \n$ sudo .\/filebeat -e -c filebeat.yml<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-3\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"598\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-31-1024x598.png\" alt=\"\" class=\"wp-image-75215\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-31-1024x598.png 1024w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-31-300x175.png 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-31-768x449.png 768w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-31-1536x897.png 1536w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-31.png 2000w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32-1024x576.png\" alt=\"\" class=\"wp-image-75216\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32-1024x576.png 1024w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32-300x169.png 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32-768x432.png 768w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32-1536x864.png 1536w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32-355x199.png 355w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2025\/05\/image-32.png 1898w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3 &#8211; Configure a filebeat.yml input with a some log file<\/h2>\n\n\n\n<p>Open the filebeat.yml file located in your Filebeat installation directory, and replace the contents with the following lines. Make sure paths points to the example Apache log file, logstash-tutorial.log, that you downloaded earlier:<\/p>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-4\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">$ vi filebeat<span class=\"hljs-number\">-7.15<\/span><span class=\"hljs-number\">.0<\/span>-linux-x86_64\/filebeat.yml\n\n<span class=\"hljs-attr\">enabled<\/span>: <span class=\"hljs-literal\">true<\/span>\n\nfilebeat.inputs:\n- type: log\n  <span class=\"hljs-attr\">paths<\/span>:\n    - <span class=\"hljs-regexp\">\/path\/<\/span>to\/file\/logstash-tutorial.log \noutput.logstash:\n  hosts: &#91;<span class=\"hljs-string\">\"localhost:5044\"<\/span>]<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-4\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"438\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-22-1024x438.png\" alt=\"\" class=\"wp-image-49237\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-22-1024x438.png 1024w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-22-300x128.png 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-22-768x328.png 768w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-22.png 1490w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"807\" height=\"377\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-1.jpg\" alt=\"\" class=\"wp-image-23836\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-1.jpg 807w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-1-300x140.jpg 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-1-768x359.jpg 768w\" sizes=\"auto, (max-width: 807px) 100vw, 807px\" \/><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4 &#8211; Configure a filebeat.yml output with Logstash or elasticsearch<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"543\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-2.jpg\" alt=\"\" class=\"wp-image-23837\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-2.jpg 936w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-2-300x174.jpg 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/install-configure-elastic-fileBeats-2-768x446.jpg 768w\" sizes=\"auto, (max-width: 936px) 100vw, 936px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"366\" src=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-21-1024x366.png\" alt=\"\" class=\"wp-image-49236\" srcset=\"https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-21-1024x366.png 1024w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-21-300x107.png 300w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-21-768x274.png 768w, https:\/\/www.devopsschool.com\/blog\/wp-content\/uploads\/2021\/09\/image-21.png 1380w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-5\" data-shcb-language-name=\"PHP\" data-shcb-language-slug=\"php\"><span><code class=\"hljs language-php\">output.elasticsearch:\n  <span class=\"hljs-comment\"># Array of hosts to connect to.<\/span>\n  hosts: &#91;<span class=\"hljs-string\">\"localhost:9200\"<\/span>]\n\n  <span class=\"hljs-comment\"># Performance preset - one of \"balanced\", \"throughput\", \"scale\",<\/span>\n  <span class=\"hljs-comment\"># \"latency\", or \"custom\".<\/span>\n  preset: balanced\n\n  <span class=\"hljs-comment\"># Protocol - either `http` (default) or `https`.<\/span>\n  protocol: <span class=\"hljs-string\">\"https\"<\/span>\n\n  <span class=\"hljs-comment\"># Authentication credentials - either API key or username\/password.<\/span>\n  <span class=\"hljs-comment\">#api_key: \"id:api_key\"<\/span>\n  username: <span class=\"hljs-string\">\"elastic\"<\/span>\n  password: <span class=\"hljs-string\">\"XM1P5CVhIJ48MlU_fPTj\"<\/span>\n  ssl.certificate_authorities: &#91;<span class=\"hljs-string\">\"\/home\/ubuntu\/elasticsearch-9.0.0\/config\/certs\/http_ca.crt\"<\/span>]\n<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-5\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">PHP<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">php<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<h2 class=\"wp-block-heading\">Step 5 &#8211; Start a logbeat<\/h2>\n\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-6\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">$ cd filebeat<span class=\"hljs-number\">-7.2<\/span><span class=\"hljs-number\">.0<\/span>-linux-x86_64\/\n$ sudo chown root filebeat.yml\n$ sudo .\/filebeat -e -c filebeat.yml -d <span class=\"hljs-string\">\"publish\"<\/span>\nor\n$ sudo .\/filebeat -e -c filebeat.yml<\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-6\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<hr class=\"wp-block-separator has-css-opacity\"\/>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-7\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">To run filebeat <span class=\"hljs-keyword\">as<\/span> a background process\n\n$ sudo .\/filebeat -e -c filebeat.yml -d <span class=\"hljs-string\">\"publish\"<\/span> &amp;\n$ screen -d -m .\/filebeat -e -c filebeat.yml -d <span class=\"hljs-string\">\"publish\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-7\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p>Filebeat will attempt to connect on port 5044. Until Logstash starts with an active Beats plugin, there won\u2019t be any answer on that port, so any messages you see regarding failure to connect on that port are normal for now.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Configuration file of filebeats<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/raw.githubusercontent.com\/devopsschool-demo-labs-projects\/elasticsearch\/master\/filebeat-config-file\/filebeat.yml\" target=\"_blank\" rel=\"noreferrer noopener\">filebeat.yml<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/raw.githubusercontent.com\/devopsschool-demo-labs-projects\/elasticsearch\/master\/filebeat-config-file\/fields.yml\" target=\"_blank\" rel=\"noreferrer noopener\">fields.yml<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/raw.githubusercontent.com\/devopsschool-demo-labs-projects\/elasticsearch\/master\/filebeat-config-file\/filebeat.reference.yml\" target=\"_blank\" rel=\"noreferrer noopener\">filebeat.reference.yml<\/a><\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<script src=\"https:\/\/gist.github.com\/devops-school\/4323a3c7ad8c76323495b4314ad8b9de.js\"><\/script>\n\n\n\n<h2 class=\"wp-block-heading\">To delete the Filebeat registry file<\/h2>\n\n\n<pre class=\"wp-block-code\" aria-describedby=\"shcb-language-8\" data-shcb-language-name=\"JavaScript\" data-shcb-language-slug=\"javascript\"><span><code class=\"hljs language-javascript\">For example, <span class=\"hljs-attr\">run<\/span>:\n\n$ cd \/home\/ec2-user\/filebeat<span class=\"hljs-number\">-7.2<\/span><span class=\"hljs-number\">.0<\/span>-linux-x86_64\n$ sudo rm -rf data\/registry\n$ sudo chown root filebeat.yml\n$ sudo .\/filebeat -e -c filebeat.yml -d <span class=\"hljs-string\">\"publish\"<\/span>\n$ sudo .\/filebeat -e -c filebeat.yml -d <span class=\"hljs-string\">\"publish\"<\/span><\/code><\/span><small class=\"shcb-language\" id=\"shcb-language-8\"><span class=\"shcb-language__label\">Code language:<\/span> <span class=\"shcb-language__name\">JavaScript<\/span> <span class=\"shcb-language__paren\">(<\/span><span class=\"shcb-language__slug\">javascript<\/span><span class=\"shcb-language__paren\">)<\/span><\/small><\/pre>\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Filebeat client is a lightweight, resource-friendly tool that collects logs from files on the server and forwards these logs to your Logstash instance for processing. Filebeat is designed for reliability&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[5936],"tags":[],"class_list":["post-23835","post","type-post","status-publish","format-standard","hentry","category-elastic"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/23835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=23835"}],"version-history":[{"count":16,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/23835\/revisions"}],"predecessor-version":[{"id":75218,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/23835\/revisions\/75218"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=23835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=23835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=23835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}