WARNING: Version 5.6 of Filebeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Filebeat Prospectors General »
Elastic Docs ›Filebeat Reference [5.6] ›Configuring Filebeat ›Configuration Options (Reference)

Filebeat Global

edit

Filebeat Global

edit

You can specify configuration options in the filebeat.yml config file to control Filebeat behavior at a global level.

Options

edit

spool_size

edit

The event count spool threshold. This setting forces a network flush if the number of events in the spooler exceeds the specified value.

filebeat.spool_size: 2048

See Load Balancing for more information about how this setting affects load balancing.

publish_async

edit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Deprecated in 5.3.0.

If enabled, the publisher pipeline in Filebeat operates in async mode preparing a new batch of lines while waiting for ACK. This option can improve load-balancing throughput at the cost of increased memory usage. The default value is false.

See Load Balancing for more information about how this setting affects load balancing.

idle_timeout

edit

A duration string that specifies how often the spooler is flushed. After the idle_timeout is reached, the spooler is flushed even if the spool_size has not been reached.

filebeat.idle_timeout: 5s

registry_file

edit

The name of the registry file. If a relative path is used, it is considered relative to the data path. See the Directory Layout section for details. The default is ${path.data}/registry.

filebeat.registry_file: registry

It is not possible to use a symlink as registry file.

The registry file is only updated when new events are flushed and not on a predefined period. That means in case there are some states where the TTL expired, these are only removed when new event are processed.

config_dir

edit

The full path to the directory that contains additional prospector configuration files. Each configuration file must end with .yml. Each config file must also specify the full Filebeat config hierarchy even though only the prospector part of the file is processed. All global options, such as spool_size, are ignored.

The config_dir option MUST point to a directory other than the directory where the main Filebeat config file resides.

If the specified path is not absolute, it is considered relative to the configuration path. See the Directory Layout section for details.

filebeat.config_dir: path/to/configs

shutdown_timeout

edit

How long Filebeat waits on shutdown for the publisher to finish sending events before Filebeat shuts down.

By default, this option is disabled, and Filebeat does not wait for the publisher to finish sending events before shutting down. This means that any events sent to the output, but not acknowledged before Filebeat shuts down, are sent again when you restart Filebeat. For more details about how this works, see How Does Filebeat Ensure At-Least-Once Delivery?.

You can configure the shutdown_timeout option to specify the maximum amount of time that Filebeat waits for the publisher to finish sending events before shutting down. If all events are acknowledged before shutdown_timeout is reached, Filebeat will shut down.

There is no recommended setting for this option because determining the correct value for shutdown_timeout depends heavily on the environment in which Filebeat is running and the current state of the output.

Example configuration:

filebeat.shutdown_timeout: 5s
« Filebeat Prospectors General »