Current rc.d script is starting with -path.home=/var/db/beats/filebeat. The correct path.home should be /usr/local/share/beats/filebeat. /var/db/beats/filebeat is only the data directory. Correct cli args should be "-path.data /var/db/beats/filebeat -path.config /usr/local/etc -path.home /usr/local/share/beats/filebeat" see diff below: --- /usr/local/etc/rc.d/filebeat.old 2020-01-06 12:52:53.000000000 +1100 +++ /usr/local/etc/rc.d/filebeat 2020-03-06 17:52:04.423819000 +1100 @@ -21,7 +21,7 @@ load_rc_config $name : ${filebeat_enable:="NO"} -: ${filebeat_config:="-path.home /var/db/beats/${name} -path.config /usr/local/etc"} +: ${filebeat_config:="-path.home=/usr/local/share/beats/${name} -path.data /var/db/beats/${name} -path.config /usr/local/etc"} Also I would suggest that path.config be /usr/local/etc/filebeat instead of /usr/local/etc
I think that etc path is pretty standard, although I'm open to reasons on why that should be changed.
A commit references this bug: Author: glewis Date: Sun Mar 22 17:28:45 UTC 2020 New revision: 528929 URL: https://svnweb.freebsd.org/changeset/ports/528929 Log: Correct the home path PR: 244627 Submitted by: TAO ZHOU <zhoutao@laocius.org> Changes: head/sysutils/beats/Makefile head/sysutils/beats/files/filebeat.in
Still looking at the etc change. You might have a point in that that is where all of the etc files for filebeat are installed. Do you run filebeat? Have you changed the etc setting and if so does this affect it?
Tao isn't working on this any more, but I've taken over maintaining our filebeat config. I've actually put the config path to /usr/local/etc/filebeat.d/ and inside that folder put inputs and modules folders, since that's how filebeat likes to arrange different log paths if you use the rc.conf.d approach of lots of small files that are easier to maintain across servers. That works well, and I like not cluttering /usr/local/etc with filebeat.yml, filebeat.yml.sample, filebeat.inputs.d, etc.
This has been fixed quite a while ago.