Keep Filebeat Windows Service running 24/7 with Service Protector

How to Keep Filebeat Windows Service Running 24/7 with Service Protector

Ensure that Filebeat automatically restarts if it is stopped for any reason — and it's always ready to process your logs

Filebeat — a component of the popular Elastic Stack — monitors log files for important events and sends relevant items to Elasticsearch or Logstash for indexing.

Filebeat is best installed as a Windows Service:

To protect Filebeat with Service Protector:

  1. Download and install Filebeat as a service, if necessary. Configure it to work as you like.

  2. Download and install Service Protector.

  3. Start Service Protector.

  4. Select Protector > Add to open the Add Protector window:

    Add Protector

  5. On the General tab, in the Service to protect field, choose the filebeat entry. You will notice a green circle on the left if the Filebeat windows service is already running (as was the case on our server):

    Filebeat Windows Service: General Tab

  6. If you would like to ensure that Filebeat remains "fresh" and survives memory leaks and other degradations, click over to the Monitor tab and setup a regular restart.

    To do so, check the At the following times box, click the Add button and enter a time when Filebeat is likely to be "quiet". Daily at midnight works for us:

    Filebeat Windows Service: Monitor Tab

  7. We are done with the recommended settings so click the Save button to record your work. In a couple of seconds, an entry for Filebeat will show up in the main window.

    The green "Protected" shield will indicate that Service Protector is actively monitoring Filebeat for crashes, interruptions and other problems:

    Filebeat Windows Service: Protected

    You can always click the green "Running" circle to see how the Filebeat service is doing:

    Filebeat Service Information

  8. That's it! Next time your computer boots, Filebeat will start and Service Protector will begin monitoring the service to promptly restart it if it fails.

    We encourage you to edit Filebeat in Service Protector and check out the many other settings that may be appropriate for your environment. For example, send an email when the service fails, terminate the service if it gets stuck stopping or starting, and much more.

Trouble protecting the Filebeat Windows Service?