How to test Filebeat output connectivity

Testing Filebeat output connectivity before a restart or rollout catches unreachable endpoints, bad credentials, and certificate problems before log shipping falls behind. It is the quickest way to prove that the configured destination is ready to accept events.

The filebeat test output subcommand reads whichever output.* block is currently enabled in the selected configuration file and walks through the same connection stages used during normal publishing. Depending on the output, that includes URL or host parsing, DNS resolution, a TCP dial, optional TLS negotiation, and an application-level handshake with the remote service.

The command does not publish a log event, but it does use the live credentials, certificate settings, and output host list from the chosen config. That makes it a safe preflight check before restarting Filebeat, although config-file permission problems, broken YAML, or config files stored outside the normal path can still change the result.

1. Run the output connectivity test against the active Filebeat configuration.

   $ sudo filebeat test output -c /etc/filebeat/filebeat.yml
   elasticsearch: http://es-node-01.example.net:9200...
     parse url... OK
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 192.0.2.20
       dial up... OK
     TLS... WARN secure connection disabled
     talk to server... OK
     version: 9.3.2

   The command uses the currently enabled output.* block with the same authentication and TLS settings that normal publishing uses.

2. Confirm the test reaches talk to server… OK, and for Elasticsearch outputs also a version: line.

   Logstash output tests usually stop after talk to server… OK, while HTTPS outputs show certificate verification and handshake details instead of the secure connection disabled warning.

   Related: How to configure Filebeat for TLS

3. Run the same test against a non-default config file when you keep staging, alternate, or task-specific Filebeat configs.

   $ sudo filebeat test output -c /etc/filebeat/filebeat-staging.yml
   elasticsearch: http://es-node-01.example.net:9200...
     parse url... OK
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 192.0.2.20
       dial up... OK
     TLS... WARN secure connection disabled
     talk to server... OK
     version: 9.3.2

   If the alternate config depends on relative paths such as modules.d files from another config directory, add --path.config so those paths resolve correctly.

4. Override an output setting at runtime when you need to test a replacement endpoint without editing the YAML file first.

   $ sudo filebeat test output -E 'output.elasticsearch.hosts=["http://es-node-02.example.net:9200"]'

   The -E override applies only to the current command and does not modify /etc/filebeat/filebeat.yml. Change the key to output.logstash.hosts or another active output.* setting when you are testing a different destination type.

5. Check the command exit status when you need a simple success or failure signal for automation.

   $ echo $?
   0

   A zero exit status means Filebeat completed the output test successfully with the selected settings.

6. Run a configuration test first when the output test fails before the connection… stage or reports YAML, ownership, or permission errors.

   $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
   Config OK

   Related: How to test a Filebeat configuration