/usr/lib/systemd/system/filebeat.service systemctl start filebeat.service systemctl enable filebeat.service

[Unit] Description=filebeat Documentation=http://www.elastic.co Wants=network-online.target After=network-online.target

[Service] User=root Group=root LimitNOFILE=100000 LimitNPROC=100000 ExecStart=/usr/local/filebeat/filebeat -c /usr/local/filebeat/filebeat.yml -d "publish"

[Install] WantedBy=multi-user.target

StandardOutput is configured to redirect to journalctl since

some error messages may be logged in standard output before

elasticsearch logging system is initialized. Elasticsearch

stores its logs in /var/log/elasticsearch and does not use

journalctl by default. If you also want to enable journalctl

logging, you can simply remove the "quiet" option from ExecStart.

StandardOutput=journal StandardError=inherit

Specifies the maximum file descriptor number that can be opened by this process

LimitNOFILE=65536

Specifies the maximum number of process

LimitNPROC=4096

Specifies the maximum size of virtual memory

LimitAS=infinity

Specifies the maximum file size

LimitFSIZE=infinity

Disable timeout logic and wait until process is stopped

TimeoutStopSec=0

SIGTERM signal is used to stop the Java process

KillSignal=SIGTERM

Send the signal only to the JVM rather than its control group

KillMode=process

Java process is never killed

SendSIGKILL=no

When a JVM receives a SIGTERM signal it exits with code 143

SuccessExitStatus=143