# Cant find data/registry on Centos 7 with yum repository,

**URL:** https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555
**Category:** Beats
**Tags:** filebeat
**Created:** [February 3, 2020, 3:55am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555 "2020-02-03T03:55:17Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [February 3, 2020, 3:55am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/1 "2020-02-03T03:55:17Z")

</div>

Hi, Im am testing configurations for a log file, and I want to use it many times, until the desired result is achieved, the problem is that I can not find the data/registry folder where the already processed files are checked. to delete it and try the same log file again

I have search the folowing paths, but they not exist:

/var/lib/filebeat/registry  
/usr/share/filebeat/data  
/etc/filebeat/data

also look for a .filebeat file, and nothing

any one knows where the registry is located?

---

<div class="post-metadata">

### Author: ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)
#### Post date: [February 3, 2020, 7:46am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/2 "2020-02-03T07:46:49Z")

</div>

@Incauto - As you can read in our [documentation](https://www.elastic.co/guide/en/beats/filebeat/7.5/configuration-general-options.html#_registry_path), the registry path will be, by default, set to `${path.data}/registry`. Depending on your installation "type" (i.e RPM, tarball, etc.), `path.data` will correspond to a different value/location as described [here](https://www.elastic.co/guide/en/beats/filebeat/7.5/directory-layout.html).

Take note that, the registry stores its data in the subdirectory `filebeat/data.json`. It also contains a meta data file named `filebeat/meta.json`. The meta file contains the file format version number.

I hope that helps.

---

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [February 3, 2020, 9:42am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/3 "2020-02-03T09:42:13Z")

</div>

Tanks ropc, I have read the documentation, I have instaled filebeat via rpm, but there is no   
/var/lib/filebeat folder, no changes on the filebeat.yml only in the input :

```auto
  paths:
   - /root/diez*.log

```

and the output:

```auto
output.console:
  pretty: true

```

the version installed is 7.5.2

---

<div class="post-metadata">

### Author: ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)
#### Post date: [February 3, 2020, 2:30pm UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/4 "2020-02-03T14:30:44Z")

</div>

@Incauto - I just tested in the lab with an RPM installation. The registry folder should be in `/var/lib/filebeat/registry`. If you are running Filebeat with `sudo service filebeat start`, it would be good to check the logs from `journald`. For example, you could run:

- `sudo journalctl -u filebeat > export.log` and check the logs. You should find similar logs that will indicate where the registry / data files are located:

```auto
INFO instance/beat.go:610 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
....
INFO registrar/migrate.go:104 No registry home found. Create: /var/lib/filebeat/registry/filebeat
INFO registrar/migrate.go:112 Initialize registry meta file
INFO registrar/registrar.go:108 No registry file found under: /var/lib/filebeat/registry/filebeat/data.json. Creating a new registry file.
INFO registrar/registrar.go:145 Loading registrar data from /var/lib/filebeat/registry/filebeat/data.json
INFO registrar/registrar.go:152 States Loaded from registrar: 0
...

```

Alternatively, you can also run Filebeat in the foreground with debug logging with the following command:

- `sudo filebeat -d "*" -e` , which will give you similar logs with additional debug logs. That could be handy, especially if there is a problem with Filebeat or the configuration.

---

<div class="post-metadata">

### Author: ![Incauto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/incauto/32/60149_2.png) [@Incauto](https://discuss.elastic.co/u/Incauto)
#### Post date: [February 4, 2020, 1:25am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/5 "2020-02-04T01:25:09Z")

</div>

Thanks rocp

so, I was running filebeat with this command, similar when I run a conf in logstash:

```auto
bin/filebeat -c /etc/filebeat/filebeat.yml

```

I never start filebeat as a service, maybe thats why the directories weren't created, still a mystery where the pointer where stored before, but its all working now.

Thanks again Romain, you have been very helpful

---

<div class="post-metadata">

### Author: ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)
#### Post date: [February 4, 2020, 1:44am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/6 "2020-02-04T01:44:58Z")

</div>

You're most welcome @Incauto 🙂

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 3, 2020, 1:45am UTC](https://discuss.elastic.co/t/cant-find-data-registry-on-centos-7-with-yum-repository/217555/7 "2020-03-03T01:45:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
