# filebeat自启动

**Published by:** [mycool2007](https://paragraph.com/@mycool2007/)
**Published on:** 2021-12-05
**URL:** https://paragraph.com/@mycool2007/filebeat

## Content

/usr/lib/systemd/system/filebeat.service systemctl start filebeat.service systemctl enable filebeat.service [Unit] Description=filebeat Documentation=http://www.elastic.co Wants=network-online.target After=network-online.target [Service] User=root Group=root LimitNOFILE=100000 LimitNPROC=100000 ExecStart=/usr/local/filebeat/filebeat -c /usr/local/filebeat/filebeat.yml -d "publish" [Install] WantedBy=multi-user.targetStandardOutput is configured to redirect to journalctl sincesome error messages may be logged in standard output beforeelasticsearch logging system is initialized. Elasticsearchstores its logs in /var/log/elasticsearch and does not usejournalctl by default. If you also want to enable journalctllogging, you can simply remove the "quiet" option from ExecStart.StandardOutput=journal StandardError=inheritSpecifies the maximum file descriptor number that can be opened by this processLimitNOFILE=65536Specifies the maximum number of processLimitNPROC=4096Specifies the maximum size of virtual memoryLimitAS=infinitySpecifies the maximum file sizeLimitFSIZE=infinityDisable timeout logic and wait until process is stoppedTimeoutStopSec=0SIGTERM signal is used to stop the Java processKillSignal=SIGTERMSend the signal only to the JVM rather than its control groupKillMode=processJava process is never killedSendSIGKILL=noWhen a JVM receives a SIGTERM signal it exits with code 143SuccessExitStatus=143 [Install] WantedBy=multi-user.target

## Publication Information

- [mycool2007](https://paragraph.com/@mycool2007/): Publication homepage
- [All Posts](https://paragraph.com/@mycool2007/): More posts from this publication
- [RSS Feed](https://api.paragraph.com/blogs/rss/@mycool2007): Subscribe to updates
- [Twitter](https://twitter.com/mycool2007): Follow on Twitter