режим инфо до рестарта

systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)
   Active: active (running) since Ср 2019-09-25 18:01:42 MSK; 1 day 2h ago
     Docs: https://www.elastic.co/products/beats/filebeat
 Main PID: 5865 (filebeat)
   CGroup: /system.slice/filebeat.service
           └─5865 /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs

сен 26 20:11:12 bisArch filebeat[5865]: 2019-09-26T20:11:12.833+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:11:42 bisArch filebeat[5865]: 2019-09-26T20:11:42.832+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:12:12 bisArch filebeat[5865]: 2019-09-26T20:12:12.832+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:12:42 bisArch filebeat[5865]: 2019-09-26T20:12:42.830+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:13:12 bisArch filebeat[5865]: 2019-09-26T20:13:12.832+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:13:42 bisArch filebeat[5865]: 2019-09-26T20:13:42.833+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:14:12 bisArch filebeat[5865]: 2019-09-26T20:14:12.832+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:14:42 bisArch filebeat[5865]: 2019-09-26T20:14:42.836+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:15:12 bisArch filebeat[5865]: 2019-09-26T20:15:12.833+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
сен 26 20:15:42 bisArch filebeat[5865]: 2019-09-26T20:15:42.830+0300        INFO        [monitoring]        log/log.go:145        Non-zero metrics in the last 30s        {"monitorin
lines 1-18/18 (END)

режим дебаг после растартам

systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
   Loaded: loaded (/lib/systemd/system/filebeat.service; disabled; vendor preset: enabled)
   Active: active (running) since Чт 2019-09-26 20:19:02 MSK; 6s ago
     Docs: https://www.elastic.co/products/beats/filebeat
 Main PID: 7690 (filebeat)
   CGroup: /system.slice/filebeat.service
           └─7690 /usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs

сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.701+0300        DEBUG        [publisher]        pipeline/client.go:200        Pipeline client receives callback 'onFilter
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.701+0300        DEBUG        [input]        file/states.go:68        New state added for /arch/nn300_201_20190924_030859
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.701+0300        DEBUG        [publisher]        pipeline/client.go:200        Pipeline client receives callback 'onFilter
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.702+0300        DEBUG        [input]        file/states.go:68        New state added for /arch/nn300_101_20190924_180933
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.701+0300        DEBUG        [acker]        beater/acker.go:64        stateful ack        {"count": 1}
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.702+0300        DEBUG        [acker]        beater/acker.go:64        stateful ack        {"count": 1}
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.702+0300        DEBUG        [registrar]        registrar/registrar.go:346        Registrar states cleaned up. Before: 24
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.702+0300        DEBUG        [publisher]        pipeline/client.go:200        Pipeline client receives callback 'onFilter
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.704+0300        DEBUG        [input]        file/states.go:68        New state added for /arch/nn300_101_20190924_135423
сен 26 20:19:07 bisArch filebeat[7690]: 2019-09-26T20:19:07.777+0300        DEBUG        [registrar]        registrar/registrar.go:411        Write registry file: /var/lib/filebeat/