# Custom beat to monitor a file in a server folder is possible?
**URL:** https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142
**Category:** Beats
**Tags:** auditbeat
**Created:** [June 1, 2022, 3:39pm UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142 "2022-06-01T15:39:45Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@dannie-ml](https://discuss.elastic.co/u/dannie-ml)
#### Post date: [June 1, 2022, 3:39pm UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142/1 "2022-06-01T15:39:45Z")
I have a doubt in making a custom beat that reads or monitors the state of a file, example:
In a server, a file is within the Inbound folder if stays the file for more than 5 minutes in this folder and doesnt move to the processed folder then the beat send like an alert or something.
Is this possible to achive? If yes, can you give some hints or where to start?
I hope that i have explained myself. Thanks in advance!
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 1, 2022, 11:15pm UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142/2 "2022-06-01T23:15:54Z")
You could probably do this with a combination of Auditbeat watching the files, and then Alerting to find files don't have a matching move record within the 5 minute window.
[File Integrity Module | Auditbeat Reference [8.2] | Elastic](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-file_integrity.html) and [examples/Alerting/Sample Watches/new\_process\_started at master · elastic/examples · GitHub](https://github.com/elastic/examples/tree/master/Alerting/Sample%20Watches/new_process_started) should get you started.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [June 2, 2022, 12:50am UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142/3 "2022-06-02T00:50:17Z")
@warkolm's solution is also what I was thinking. You could probably aggregate on the file names (assuming they are unique) and then do a sub-aggregation on the `event.action` field. Then alert an any file whose event.action agg does not contain `created` and `moved`.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 30, 2022, 2:50am UTC](https://discuss.elastic.co/t/custom-beat-to-monitor-a-file-in-a-server-folder-is-possible/306142/4 "2022-06-30T02:50:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.