WARNING: Version 5.1 of Metricbeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
logging section of the
metricbeat.yml config file contains options
for configuring the Beats logging output. The logging system can write logs to
syslog or rotate log files. If logging is not explicitly configured, file output
is used on Windows systems, and syslog output is used on Linux and OS X.
logging.level: warning logging.to_files: true logging.to_syslog: false logging.files: path: /var/log/mybeat name: mybeat.log keepfiles: 7
In addition to the logging system, the logging output configuration can be modified from the command line.
You can specify the following options in the
logging section of the
metricbeat.yml config file:
Minimum log level. One of debug, info, warning, error or critical. If debug is
used, but no selectors are configured, the
* selector will be used.
The default log level is "info".
The list of debugging-only selector tags used by different Beats components. Use
to enable debug output for all components. For example add
publish to display
all the debug messages related to event publishing. When starting the Beat,
selectors can be overwritten using the
-d command line option (
-d also sets
the debug log level).
If enabled, Metricbeat periodically logs its internal metrics that have changed in the last period. For each metric that changed, the delta from the value at the beginning of the period is logged. Also, the total values for all non-zero internal metrics are logged on shutdown. The default is true.
Here is an example log line:
2016/07/04 12:16:10.821047 logp.go:194: INFO Non-zero metrics in the last 30s: libbeatEsPublishedAndAckedEvents=18 libbeatEsPublishWriteBytes=10045
Note that we currently offer no backwards compatible guarantees for the internal metrics and for this reason they are also not documented.
The directory that log files are written to. The default is the logs path. See the Directory Layout section for details.
The maximum size of a log file. If the limit is reached, a new log file is generated. The default size limit is 10485760 (10 MB).
The logging format is different for each logging type:
- to syslog: Syslog adds the timestamp itself.
to file: RFC 3339 format is used for the timestamp:
2006-01-02T15:04:05Z07:00 WARN log-message. The format includes the timezone followed by the logging level.
to stderr: UTC format is used for the timestamp:
2015/11/12 09:03:37.369262 geolite.go:52: WARN log-message. The format includes the UTC timestamp with the milliseconds, then the name of the caller that sent the log entry followed by the logging level. This option should be used mainly for debugging.