How to Uninstall Filebeat on Ubuntu

How to Uninstall Filebeat on Ubuntu

Filebeat is a lightweight shipper for forwarding and centralizing log data. While it’s a valuable tool for many administrators, there may come a time when you need to uninstall it from your Ubuntu system. This guide will walk you through the steps to safely and completely remove Filebeat from your Ubuntu server or desktop.

Before diving into the uninstallation process, it’s essential to understand the different components of Filebeat and how they interact with your system. Filebeat typically consists of the main binary, configuration files, and data directories. When uninstalling, it’s crucial to ensure that all these components are removed to prevent any potential issues in the future.

Let’s get started.

Step 1: Stop the Filebeat Service

Before uninstalling any software, it’s a good practice to stop its services to ensure a smooth removal process.

sudo systemctl stop filebeat

Step 2: Uninstall Filebeat

Now that the service is stopped, you can proceed to uninstall Filebeat using the package manager.

sudo apt-get purge filebeat

This command will remove Filebeat and its configuration files.

See also  How to Uninstall Spark on Ubuntu

Step 3: Remove Data Directories

Filebeat might have created data directories during its operation. To ensure a complete removal, delete these directories.

sudo rm -r /var/lib/filebeat
sudo rm -r /etc/filebeat

Step 4: Optional – Remove Related Repositories

If you added the Elastic repository when you installed Filebeat, you might want to remove it as well.

sudo rm /etc/apt/sources.list.d/elastic-7.x.list

Then, update the package database:

sudo apt-get update

Step 5: Verify Uninstallation

To ensure that Filebeat has been completely removed, you can try running:

filebeat version

If the system responds with a message indicating that the command ‘filebeat’ is not found, then the uninstallation was successful.

See also  How to Uninstall WHM on Ubuntu

Commands Mentioned

  • sudo systemctl stop filebeat – Stops the Filebeat service
  • sudo apt-get purge filebeat – Uninstalls Filebeat and its configuration files
  • sudo rm -r /var/lib/filebeat – Removes Filebeat’s data directory
  • sudo rm -r /etc/filebeat – Removes Filebeat’s configuration directory
  • sudo rm /etc/apt/sources.list.d/elastic-7.x.list – Removes the Elastic repository
  • sudo apt-get update – Updates the package database
  • filebeat version – Checks the Filebeat version


  1. Why would I need to uninstall Filebeat?

    There could be several reasons, such as switching to a different log shipper, cleaning up the system, or troubleshooting issues related to Filebeat.

  2. Is it safe to remove the Elastic repository?

    Yes, if you’re not using any other Elastic products. However, if you have other Elastic products installed, it’s best to keep the repository.

  3. What’s the difference between ‘purge’ and ‘remove’ in apt-get?

    ‘Purge’ removes the package and its configuration files, while ‘remove’ only deletes the package but leaves the configuration files intact.

  4. Can I reinstall Filebeat after uninstalling it?

    Yes, you can reinstall Filebeat anytime after uninstalling it. Just follow the installation guide provided by Elastic.

  5. Do I need to restart my server after uninstalling Filebeat?

    No, a restart is not necessary after uninstalling Filebeat. However, it’s always a good practice to monitor the system for any unexpected behavior after making changes.

See also  How to Uninstall Kafka on Ubuntu


Uninstalling Filebeat on Ubuntu is a straightforward process, but it’s essential to follow the steps carefully to ensure a complete removal. By stopping the service, using the package manager to uninstall, and manually removing data directories, you can ensure that Filebeat is entirely removed from your system.

Always remember to verify the uninstallation to avoid any future complications.


Leave a Reply

Your email address will not be published. Required fields are marked *