﻿---
title: Start Filebeat
description: Before starting Filebeat: Follow the steps in Quick start: installation and configuration to install, configure, and set up the Filebeat environment.Make...
url: https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/filebeat-starting
applies_to:
  - Elastic Stack: Generally available in 9.0+
---

# Start Filebeat
Before starting Filebeat:
- Follow the steps in [Quick start: installation and configuration](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/filebeat-installation-configuration) to install, configure, and set up the Filebeat environment.
- Make sure Kibana and Elasticsearch are running.
- Make sure the user specified in `filebeat.yml` is [authorized to publish events](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/privileges-to-publish-events).

To start Filebeat, run:
<tab-set>
  <tab-item title="DEB">
    ```sh
    sudo service filebeat start
    ```

    <note>
      If you use an `init.d` script to start Filebeat, you can’t specify command line flags (see [Command reference](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/command-line-options)). To specify flags, start Filebeat in the foreground.
    </note>
    Also see [Filebeat and systemd](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/running-with-systemd).
  </tab-item>

  <tab-item title="RPM">
    ```sh
    sudo service filebeat start
    ```

    <note>
      If you use an `init.d` script to start Filebeat, you can’t specify command line flags (see [Command reference](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/command-line-options)). To specify flags, start Filebeat in the foreground.
    </note>
    Also see [Filebeat and systemd](https://docs-v3-preview.elastic.dev/elastic/beats/pull/48504/reference/filebeat/running-with-systemd).
  </tab-item>

  <tab-item title="MacOS">
    ```sh
    sudo chown root filebeat.yml 
    sudo chown root modules.d/{modulename}.yml 
    sudo ./filebeat -e
    ```
  </tab-item>

  <tab-item title="Linux">
    ```sh
    sudo chown root filebeat.yml 
    sudo chown root modules.d/{modulename}.yml 
    sudo ./filebeat -e
    ```
  </tab-item>

  <tab-item title="Windows">
    ```sh
    PS C:\Program Files\filebeat> Start-Service filebeat
    ```
    The default location where Windows log files are stored varies:
    - <applies-to>Elastic Stack: Generally available since 9.0</applies-to> `C:\Program Files\Filebeat-Data\logs`
    - <applies-to>Elastic Stack: Generally available since 9.0</applies-to> `C:\ProgramData\filebeat\logs`
  </tab-item>
</tab-set>