How to test Filebeat output connectivity

Testing Filebeat output connectivity prevents silent log shipping gaps by confirming the configured destination is reachable before production events start publishing.

The filebeat test output command reads the active output.* section from /etc/filebeat/filebeat.yml (or a specified config) and runs connectivity checks without shipping real events. Output testing typically includes URL parsing, DNS resolution, TCP connection, optional TLS handshake, and an application-level check such as a talk to server request.

The test uses the same credentials and certificate settings configured for normal operation, so failures usually map directly to misconfigured endpoints, blocked ports, untrusted certificate chains, or authentication problems. Disabling certificate verification can make a TLS error disappear, but it also weakens transport security and can expose credentials and log data to interception.

1. Run the Filebeat output connectivity test using the active configuration.

   $ sudo filebeat test output
   logstash: localhost:5044...
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 127.0.0.1, ::1
       dial up... OK
     TLS... WARN secure connection disabled
     talk to server... OK

   Different outputs report different stages, so Logstash tests may not include a version: line.

2. Run the same test against a non-default configuration file when multiple configs exist.

   $ sudo filebeat test output -c /etc/filebeat/filebeat-staging.yml
   elasticsearch: https://localhost:9200...
     parse url... OK
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 127.0.0.1, ::1
       dial up... OK
     TLS...
       security: server's certificate chain verification is enabled
       handshake... OK
       TLS version: TLSv1.3
       dial up... OK
     talk to server... OK
     version: 8.19.9

   Different outputs report different stages, so Logstash tests may not include a version: line.

3. Override the output destination at runtime to test a new endpoint without editing the configuration file.

   $ sudo filebeat test output -E 'output.logstash.hosts=["127.0.0.1:5044"]'
   logstash: 127.0.0.1:5044...
     connection...
       parse host... OK
       dns lookup... OK
       addresses: 127.0.0.1
       dial up... OK
     TLS... WARN secure connection disabled
     talk to server... OK

   The -E flag applies only to the current run and does not modify /etc/filebeat/filebeat.yml.

4. Verify the output test returns exit status 0 for use in scripts and automation.

   $ echo $?
   0