How to enable the Filebeat HTTP endpoint

Enabling the Filebeat HTTP endpoint exposes runtime metadata and metrics for monitoring and troubleshooting. The endpoint provides a quick way to confirm Filebeat is healthy, detect publishing failures, and inspect pipeline activity without relying on log parsing alone.

When http.enabled is set in the Filebeat YAML configuration, Filebeat starts an embedded HTTP server bound to the configured http.host and http.port. The server returns JSON responses on endpoints such as

/

(basic beat information) and

/stats

(counters and runtime statistics) that can be queried locally with curl.

The endpoint is unauthenticated by default, so binding to anything beyond localhost can expose internal operational details such as version, host name, and event counters. Keep the listener on 127.0.0.1 unless a trusted network segment and firewall policy are in place, and validate YAML changes before restarting the filebeat service to avoid startup failures.

1. Open the /etc/filebeat/filebeat.yml configuration file.

   $ sudo nano /etc/filebeat/filebeat.yml

2. Add the HTTP endpoint settings to /etc/filebeat/filebeat.yml.

   http.enabled: true
   http.host: "127.0.0.1"
   http.port: 5066

   Setting http.host to 0.0.0.0 exposes the endpoint on all interfaces without authentication.

3. Test the Filebeat configuration for syntax errors.

   $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
   Config OK

   Related: How to test a Filebeat configuration

4. Restart the Filebeat service to apply the endpoint settings.

   $ sudo systemctl restart filebeat

   Related: How to manage the Filebeat service with systemctl in Linux

5. Confirm Filebeat is listening on the configured host and port.

   $ sudo ss -ltnp | grep ':5066'
   LISTEN 0      4096            127.0.0.1:5066       0.0.0.0:*    users:(("filebeat",pid=6784,fd=7))

   A bind to 127.0.0.1 limits access to localhost.

6. Query the HTTP endpoint root for status.

   $ curl -s http://127.0.0.1:5066/ | jq .
   {
     "beat": "filebeat",
     "binary_arch": "arm64",
     "build_commit": "044579ba343a33f2594ab0af5d8778f23d813c7b",
     "build_time": "2025-12-16T19:01:52.000Z",
     "elastic_licensed": true,
     "ephemeral_id": "3ad43bc0-574c-4f82-918a-73c5e8895f88",
     "gid": "0",
     "hostname": "host",
     "name": "host",
     "uid": "0",
     "username": "root",
     "uuid": "6115baa0-9dbc-4fd1-96b2-05cb49f81b9b",
     "version": "8.19.9"
   }

7. Query the

   /stats

   endpoint for runtime metrics.

   $ curl -s http://127.0.0.1:5066/stats | jq . | head -n 40
   {
     "beat": {
       "cpu": {
         "system": {
           "ticks": 10,
           "time": {
             "ms": 10
           }
         },
         "total": {
           "ticks": 50,
           "time": {
             "ms": 50
           },
           "value": 50
         },
         "user": {
           "ticks": 40,
           "time": {
             "ms": 40
           }
         }
       },
       "handles": {
         "limit": {
           "hard": 1048576,
           "soft": 1048575
         },
         "open": 12
       },
       "info": {
         "ephemeral_id": "3ad43bc0-574c-4f82-918a-73c5e8895f88",
         "name": "filebeat",
         "uptime": {
           "ms": 42072
         },
         "version": "8.19.9"
       },
       "memstats": {
         "gc_next": 18309298,
   ##### snipped #####
   }

   The

   /stats

   response can be large; use it to confirm counters are increasing and output errors are not accumulating.