systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
Active: failed (Result: start-limit) since 二 2022-11-08 14:56:51 CST; 7s ago
Docs: https://www.elastic.co/products/beats/filebeat
Process: 26277 ExecStart=/usr/share/filebeat/bin/filebeat $BEAT_LOG_OPTS $BEAT_CONFIG_OPTS $BEAT_PATH_OPTS (code=exited, status=1/FAILURE)
Main PID: 26277 (code=exited, status=1/FAILURE)
11月 08 14:56:51 cyzygjnode2 systemd[1]: Unit filebeat.service entered failed state.
11月 08 14:56:51 cyzygjnode2 systemd[1]: filebeat.service failed.
11月 08 14:56:51 cyzygjnode2 systemd[1]: filebeat.service holdoff time over, scheduling restart.
11月 08 14:56:51 cyzygjnode2 systemd[1]: Stopped Filebeat sends log files to Logstash or directly to El...ch..
11月 08 14:56:51 cyzygjnode2 systemd[1]: start request repeated too quickly for filebeat.service
11月 08 14:56:51 cyzygjnode2 systemd[1]: Failed to start Filebeat sends log files to Logstash or direct...ch..
11月 08 14:56:51 cyzygjnode2 systemd[1]: Unit filebeat.service entered failed state.
11月 08 14:56:51 cyzygjnode2 systemd[1]: filebeat.service failed.
Hint: Some lines were ellipsized, use -l to show in full.
根据提示使用 -l 查看，也看不出啥原因。后再网上翻了下，有人说不要用systemctl启动，直接用命令启动，在其他正常启动的服务器启上copy命令过来执行。可使用systemctl -l status filebeat查看具体的启动命令。
/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat
Exiting: error loading config file: config file ("/etc/filebeat/filebeat.yml") can only be writable by the owner but the permissions are "-rw-rw-rw-" (to fix the permissions use: 'chmod go-w /etc/filebeat/filebeat.yml')
看到是因为filebeat.yml权限导致。根据提示修改权限后，使用systemctl启动成功。
标签：filebeat,service,over,56,51,Filebeat,systemd,08 From： https://www.cnblogs.com/Shieryue/p/16869892.html