How to configure a Filebeat console output

Enabling output.console in Filebeat makes collected events visible immediately, which is useful for validating inputs, processors, and field enrichment before data is shipped elsewhere or stored long term.

Filebeat supports a single active output at a time, and the console output writes each published event as JSON to standard output. Setting pretty formats the JSON across multiple lines, which makes field names and nested structures easier to inspect.

Console output is designed for short debugging sessions, not continuous production ingestion. Leaving it enabled can prevent events from reaching Elasticsearch, Logstash, or other intended destinations, and systemd-managed runs may generate large journal entries. Configuration paths can differ for container or archive installs, but the output settings behave the same.

1. Open the Filebeat configuration file.

   $ sudo nano /etc/filebeat/filebeat.yml

2. Set output.console as the only enabled Filebeat output.

   #output.elasticsearch:
   #  hosts: ["http://localhost:9200"]
   
   #output.logstash:
   #  hosts: ["localhost:5044"]
   
   output.console:
     pretty: true

   Any previously configured output is disabled while output.console is enabled, so events will not be shipped to the usual destination until the original output is restored.

3. Test the configuration for syntax errors.

   $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
   Config OK

   Related: How to test a Filebeat configuration

4. Stop the Filebeat service.

   $ sudo systemctl stop filebeat

   Related: How to manage the Filebeat service with systemctl in Linux

5. Run Filebeat in the foreground to print events to the console.

   $ sudo filebeat -e -c /etc/filebeat/filebeat.yml
   {
     "@timestamp": "2026-01-06T22:41:34.351Z",
     "@metadata": {
       "beat": "filebeat",
       "type": "_doc",
       "version": "8.19.9"
     },
     "ecs": {
       "version": "8.0.0"
     },
     "host": {
       "name": "host"
     },
     "agent": {
       "ephemeral_id": "807ae88e-547c-4f62-8b35-dcf1d3a81c40",
       "id": "6115baa0-9dbc-4fd1-96b2-05cb49f81b9b",
       "name": "host",
       "type": "filebeat",
       "version": "8.19.9"
     },
     "log": {
       "offset": 0,
       "file": {
         "path": "/var/log/app.log"
       }
     },
     "message": "example log line",
     "input": {
       "type": "log"
     }
   }

   No JSON blocks appear when no input or module is actively harvesting logs.

6. Stop the foreground Filebeat process.

   ^C

7. Start the Filebeat service.

   $ sudo systemctl start filebeat

   Related: How to manage the Filebeat service with systemctl in Linux

8. Verify the service is running without errors.

   $ sudo systemctl status filebeat --no-pager
   ● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
        Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: enabled)
       Drop-In: /etc/systemd/system/filebeat.service.d
                └─env.conf
        Active: active (running) since Tue 2026-01-06 22:41:43 UTC; 3s ago
   ##### snipped #####

   Related: How to manage the Filebeat service with systemctl in Linux