How to enable the Filebeat HTTP endpoint

Enabling the Filebeat HTTP endpoint exposes runtime metadata and counters without having to dig through service logs or wait for downstream dashboards to show problems. That makes it one of the fastest ways to confirm that Filebeat is up, listening, and publishing as expected after a configuration change or pipeline check.

When http.enabled is turned on, Filebeat starts a small local API that answers requests on /, /stats, and /inputs/. Current Elastic docs keep the feature disabled by default, use localhost and port 5066 as the defaults, and support built-in pretty-printing with ?pretty so responses can be inspected directly with curl.

Current Elastic docs still describe the endpoint as experimental or technical-preview functionality, and the responses are unauthenticated unless extra network controls are added around them. Keep the listener on localhost or 127.0.0.1, leave http.pprof.enabled off unless short local profiling is required, and validate /etc/filebeat/filebeat.yml before restarting the filebeat service.

Steps to enable the Filebeat HTTP endpoint:

Open the /etc/filebeat/filebeat.yml configuration file.
```
$ sudo nano /etc/filebeat/filebeat.yml
```
Package-based Linux installs keep the main config here. Archive or container layouts use the same settings with a different config path.
Add the HTTP endpoint settings to /etc/filebeat/filebeat.yml.
```
http.enabled: true
http.host: "127.0.0.1"
http.port: 5066
```
Using 127.0.0.1 keeps the bind explicit on local IPv4. localhost is also supported and remains the documented default.

Binding the endpoint to 0.0.0.0 or a routable address exposes runtime and host metadata without authentication unless a trusted network and external access controls already protect it.
Test the Filebeat configuration before restarting the service.
```
$ sudo filebeat test config -c /etc/filebeat/filebeat.yml
Config OK
```
Related: How to test a Filebeat configuration
Restart the Filebeat service to apply the endpoint settings.
```
$ sudo systemctl restart filebeat
```
Related: How to manage the Filebeat service with systemctl in Linux
Confirm that Filebeat is listening on port 5066.
```
$ sudo ss -ltnp | grep ':5066'
LISTEN 0      4096       127.0.0.1:5066      0.0.0.0:*    users:(("filebeat",pid=3715,fd=4))
```
A local-only bind on 127.0.0.1 or ::1 confirms that the endpoint is not exposed beyond the host.

Query the endpoint root for basic beat information.

$ curl -sS --fail http://127.0.0.1:5066/?pretty
{
  "beat": "filebeat",
  "hostname": "loghost01",
  "name": "loghost01",
  "uuid": "34f6c6e1-45a8-4b12-9125-11b3e6e89866",
  "version": "9.3.2"
}

Current releases can also include build, architecture, and license fields in the root response.

Query the

/stats

endpoint for runtime counters and pipeline metrics.

$ curl -sS --fail http://127.0.0.1:5066/stats?pretty | sed -n '1,40p'
{
  "beat": {
    "cpu": {
      "system": {
        "ticks": 60,
        "time": {
          "ms": 60
        }
      },
      "total": {
        "ticks": 130,
        "time": {
          "ms": 130
        },
        "value": 130
      },
      "user": {
        "ticks": 70,
        "time": {
          "ms": 70
        }
      }
    },
    "handles": {
      "limit": {
        "hard": 1048576,
        "soft": 1048576
      },
      "open": 12
    },
##### snipped #####

Use this response to inspect beat runtime details plus libbeat and filebeat counters such as published events, retries, and running harvesters.

Query the

/inputs/

endpoint when per-input metrics are needed.

$ curl -sS --fail http://127.0.0.1:5066/inputs/?pretty
[
  {
    "id": "my-filestream-id",
    "input": "filestream",
    "events_pipeline_total": 0,
    "files_active": 0,
    "messages_read_total": 0
##### snipped #####
  }
]

Each object represents one running input instance. Idle inputs can legitimately show zeros until Filebeat begins reading data.