How to configure a Filebeat console output

Turning on the Filebeat console output makes each published event visible immediately, which is useful when checking harvested data, processor changes, and field enrichment before logs are shipped to a long-term destination.

Filebeat can publish to only one active output at a time. When output.console is enabled, events are written to standard output as JSON, and pretty: true expands the JSON across multiple lines so nested fields and metadata are easier to inspect during short debugging sessions.

On DEB or RPM installations, Filebeat normally runs as the filebeat.service systemd unit, while archive or container installs are usually started directly with the filebeat binary. Because console output replaces the normal shipping destination and can generate large terminal or journal output, it should be enabled briefly and then reverted to the previous output after the check is complete.

Steps to configure a Filebeat console output:

Open the Filebeat configuration file.
```
$ sudo nano /etc/filebeat/filebeat.yml
```
Use the packaged Linux path shown here unless the current deployment uses an archive or container layout with a different config location.
Disable other outputs and enable the console output.
```
#output.elasticsearch:
#  hosts: ["https://es.example.net:9200"]

output.console:
  pretty: true
```
Filebeat supports only one active output.* block, so comment out any existing output.elasticsearch, output.logstash, output.kafka, output.redis, or output.file section before enabling output.console.

pretty: true produces multi-line JSON for easier inspection; omit it or set it to false for compact one-line output.
Test the configuration for syntax errors.
```
$ sudo filebeat test config -c /etc/filebeat/filebeat.yml
Config OK
```
Related: How to test a Filebeat configuration
Stop the Filebeat service.
```
$ sudo systemctl stop filebeat
```
Related: How to manage the Filebeat service with systemctl in Linux

Run Filebeat in the foreground to print harvested events to the terminal.

$ sudo filebeat -e -c /etc/filebeat/filebeat.yml
{
  "@timestamp": "2026-04-02T11:16:09.358Z",
  "@metadata": {
    "beat": "filebeat",
    "type": "_doc",
    "version": "9.3.1"
  },
  "message": "example log line",
  "ecs": {
    "version": "8.0.0"
  },
  "host": {
    "name": "loghost01"
  },
  "agent": {
    "type": "filebeat",
    "version": "9.3.1"
  }
}

The -e flag keeps Filebeat logs in the terminal while output.console writes event JSON to standard output. Exact fields vary by input, processors, and harvested data, and no JSON is printed until an active input publishes an event.

Stop the foreground Filebeat process after the required events have been reviewed.
```
^C
```
Restore the original output block and comment out output.console when the console check is complete.

Leaving output.console enabled prevents Filebeat from sending events to its usual destination and can flood the systemd journal when the service runs in the background.
Test the restored configuration before returning the service to normal operation.
```
$ sudo filebeat test config -c /etc/filebeat/filebeat.yml
Config OK
```
Related: How to test a Filebeat configuration
Start the Filebeat service again.
```
$ sudo systemctl start filebeat
```
Related: How to manage the Filebeat service with systemctl in Linux

Verify the Filebeat service is active without new startup errors.

$ sudo systemctl status filebeat --no-pager
● filebeat.service - Filebeat sends log files to Logstash or Elasticsearch.
     Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: enabled)
     Active: active (running) since Wed 2026-04-02 11:19:04 UTC; 3s ago
##### snipped #####