Override configuration settings at the command line
editOverride configuration settings at the command line
editIf you’re running Filebeat as a service, you can’t specify command-line flags. To specify flags, start Filebeat in the foreground.
You can override any configuration setting from the command line by using flags:
-
-E, --E "SETTING_NAME=VALUE"
- Overrides a specific configuration setting.
-
-M, --M "VAR_NAME=VALUE"
- Overrides the default configuration for a module.
You can specify multiple overrides. Overrides are applied to the currently running Filebeat process. The Filebeat configuration file is not changed.
Example: override configuration file settings
editThe following configuration sends logging output to files:
logging.level: info logging.to_files: true logging.files: path: /var/log/filebeat name: filebeat keepfiles: 7 permissions: 0640
To override the logging level and send logging output to standard error instead
of a file, use the -E
flag when you run Filebeat:
-E "logging.to_files=false" -E "logging.to_stderr=true" -E "logging.level=error"
Example: override module settings
editThe following configuration sets the path to Nginx access logs:
To override this setting from the command line, use the -M
flag when you run
Filebeat. The variable name must include the module and fileset name. For
example:
-M "nginx.access.var.paths=[/path/to/log/nginx/access.log*]"
You can specify multiple overrides. Each override must start with -M
.
For information about specific variables that you can set for each fileset, see the documentation under Modules.