This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Packetbeat and systemd Stop Packetbeat »

› ›

Start Packetbeat

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Start Packetbeat

edit

Before starting Packetbeat:

Follow the steps in Quick start: installation and configuration to install, configure, and set up the Packetbeat environment.
Make sure Kibana and Elasticsearch are running.
Make sure the user specified in packetbeat.yml is authorized to publish events.

To start Packetbeat, run:

sudo service packetbeat start

Also see Packetbeat and systemd.

sudo service packetbeat start

Also see Packetbeat and systemd.

sudo chown root packetbeat.yml 
sudo ./packetbeat -e

You’ll be running Packetbeat as root, so you need to change ownership of the configuration file, or run Packetbeat with --strict.perms=false specified. See Config File Ownership and Permissions.

sudo chown root packetbeat.yml 
sudo ./packetbeat -e

You’ll be running Packetbeat as root, so you need to change ownership of the configuration file, or run Packetbeat with --strict.perms=false specified. See Config File Ownership and Permissions.

PS C:\Program Files\packetbeat> Start-Service packetbeat

By default, Windows log files are stored in C:\ProgramData\packetbeat\Logs.

« Packetbeat and systemd Stop Packetbeat »