# Can filebeat recognize .gz log files?

**URL:** <https://discuss.elastic.co/t/can-filebeat-recognize-gz-log-files/332961>\
**Category:** Logstash\
**Created:** [May 9, 2023, 3:06pm UTC](https://discuss.elastic.co/t/can-filebeat-recognize-gz-log-files/332961 "2023-05-09T15:06:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![talka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/talka/32/120811_2.png) [@talka](https://discuss.elastic.co/u/talka)\
**Post date:** [May 9, 2023, 3:06pm UTC](https://discuss.elastic.co/t/can-filebeat-recognize-gz-log-files/332961/1 "2023-05-09T15:06:24Z")

</div>

Hi,  
I'm using filebeat version 8.7.0.

/var/log list the following files:  
-rwxrwxrwx 1 1000 1000 244631 Mar 21 06:30 cron  
-rwxrwxrwx 1 1000 1000 48940 Feb 26 03:37 cron-20230226.gz  
-rwxrwxrwx 1 1000 1000 48766 Mar 5 03:31 cron-20230305.gz  
-rwxrwxrwx 1 1000 1000 49153 Mar 12 03:22 cron-20230312.gz  
-rwxrwxrwx 1 1000 1000 48982 Mar 19 03:39 cron-20230319.gz

filebeat.yml is configured as following:

- type: log  
paths:
  - /var/log/cron\*  
encoding: plain  
fields:  
tag: cron  
close\_eof: true

The problem is that only cron file is recognized while other cron\*.gz file aren't recognized.

Any idea how exactly need to define so all \*.gz files will be recognized?

Thanks, Tal.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [May 11, 2023, 2:49am UTC](https://discuss.elastic.co/t/can-filebeat-recognize-gz-log-files/332961/2 "2023-05-11T02:49:18Z")

</div>

Hi @talka Welcome to the communty!

Sorry to have your first post be this...

Currently, beats do not support backfilling archived logs. ☹

You have 2 choices ...  
Temporaryily uncompress them or  
perhaps take a look at [this solution](https://discuss.elastic.co/t/filebeat-on-demand-loading-compressed-gz-files-from-stdin/184159)

Yeah, I know... painful but that is where we stand

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2023, 2:49am UTC](https://discuss.elastic.co/t/can-filebeat-recognize-gz-log-files/332961/3 "2023-06-08T02:49:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.