# Cannot see filebeat process logs

**URL:** <https://discuss.elastic.co/t/cannot-see-filebeat-process-logs/219364>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 14, 2020, 12:42pm UTC](https://discuss.elastic.co/t/cannot-see-filebeat-process-logs/219364 "2020-02-14T12:42:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [February 14, 2020, 12:42pm UTC](https://discuss.elastic.co/t/cannot-see-filebeat-process-logs/219364/1 "2020-02-14T12:42:27Z")

</div>

Hi

I have installed filebeat 7.5 on a Ubuntu machine - even though I enabled logging, I don't see filebeat's own logs being written to file or even the file being created at **/var/log/filebeat**

I added more info to the configuration hoping that would work but I still don't see logs

This is the printed in the system service status:

`/usr/share/filebeat/bin/filebeat -e -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat`

And this is what the log section of filebeat.yml looks like now:

```
logging.level: info logging.to_files: true
logging.files:
path: /var/log/filebeat
name: filebeat
keepfiles: 7
permissions: 064
```

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [February 18, 2020, 7:54pm UTC](https://discuss.elastic.co/t/cannot-see-filebeat-process-logs/219364/2 "2020-02-18T19:54:09Z")

</div>

Looking at the log section of `filebeat.yml` that you posted here, there seems to be no indentation at all. YAML is sensitive to indentation and incorrect indentation can cause unexpected behavior.

Are you sure this is _exactly_ how the log section of your `filebeat.yml` is formatted?

---

<div class="post-metadata">

**Author:** ![samiujan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samiujan/32/23605_2.png) [@samiujan](https://discuss.elastic.co/u/samiujan)\
**Post date:** [February 21, 2020, 6:14am UTC](https://discuss.elastic.co/t/cannot-see-filebeat-process-logs/219364/3 "2020-02-21T06:14:38Z")

</div>

Sorry for the late reply - I modified the above configuration block and set it to the following:

![filebeat](https://us1.discourse-cdn.com/elastic/original/3X/e/c/ec2601809b05828b72301dec6088b421213640ee.png)

But I don't see the file:

```
root@machine-1:~# ls -lrt /var/log/filebeat
ls: cannot access '/var/log/filebeat': No such file or directory
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2020, 6:14am UTC](https://discuss.elastic.co/t/cannot-see-filebeat-process-logs/219364/4 "2020-03-20T06:14:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.