Override configuration settings at the command line
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
If you’re running Filebeat as a service, you can’t specify command-line flags. To specify flags, start Filebeat in the foreground.
You can override any configuration setting from the command line by using flags:
-E, --E "SETTING_NAME=VALUE"- Overrides a specific configuration setting.
-M, --M "VAR_NAME=VALUE"- Overrides the default configuration for a module.
You can specify multiple overrides. Overrides are applied to the currently running Filebeat process. The Filebeat configuration file is not changed.
The following configuration sends logging output to files:
logging.level: info
logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 0640
To override the logging level and send logging output to standard error instead of a file, use the -E flag when you run Filebeat:
-E "logging.to_files=false" -E "logging.to_stderr=true" -E "logging.level=error"
The following configuration sets the path to Nginx access logs:
- module: nginx
access:
var.paths: ["/var/log/nginx/access.log*"]
To override the var.paths setting from the command line, use the -M flag when you run Filebeat. The variable name must include the module and fileset name. For example:
-M "nginx.access.var.paths=[/path/to/log/nginx/access.log*]"
You can specify multiple overrides. Each override must start with -M.
For information about specific variables that you can set for each fileset, see the documentation under Modules.