Beats: start beats as a background process

[huygn]

I know we can do something like filebeat -c filebeat.yml &, but I'd love to have an official run option.

[kkirsche]

Please be aware that there are known runtime concerns with daemonizing within Golang golang/go#227 there are also additional concerns for daemonizing if a goroutine has occurred prior to the event.

[vi-nu]

you can install it as a service:

https://www.elastic.co/guide/en/beats/libbeat/current/setup-repositories.html

then you can use #service filebeat start

[LakshithaH]

Installing filebeat as a service is a problem when you don't have sudo privileges. Better if we can have a demon start and stop like this

filebeat -c filebeat.yml start
filebeat -c filebeat.yml stop

[romberli]

i also wonder why there is no option like --daemon or -d, to start it as background process...

[tarun7631]

use screen -d -m ./filebeat -e -c filebeat.yml -d "publish" to run filebeat as a background process

[kkirsche]

Or the simpler nohup longrunningcmd &

Either way, neither screen or nohup are replacements for service management systems like systemd, etc.

[romain-chanu]

If you run nohup filebeat & in a SSH session and the SSH session is closed, the filebeat process will be stopped. There is a signal handler implemented in the beats code. I believe this overwrites the signal handler set by nohup in the first place. Running filebeat as a service (sudo service filebeat start) would be an alternative.