# Different files to same index

**URL:** <https://discuss.elastic.co/t/different-files-to-same-index/186553>\
**Category:** Beats\
**Created:** [June 19, 2019, 10:36pm UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553 "2019-06-19T22:36:16Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![robymemo](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@robymemo](https://discuss.elastic.co/u/robymemo)\
**Post date:** [June 19, 2019, 10:36pm UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/1 "2019-06-19T22:36:16Z")

</div>

Hi,

## I have this simply configuration on filebeat.inputs

filebeat.inputs:

- type: log  
paths:
  - /var/log/test.log
  - /var/log/temp\_tst/\*.log

* * *

the beats are loaded on a single index . I'm not understanding why is considered ONLY the file 'test.log' under the first path . The files under the second path are not considered!!!  
The file are the same but with different number of records.

The index was created but basing only on the file under the first path!

I'm really not able to understand which is the problem .... anyone can help me ?

Thanks

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [June 20, 2019, 1:44am UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/2 "2019-06-20T01:44:38Z")

</div>

Look in filebeat logs, if you don't see messages for filebeat to attempt to harvest the 2nd dir, you may have the pattern incorrect.

If filebeat running as root?

---

<div class="post-metadata">

**Author:** ![robymemo](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@robymemo](https://discuss.elastic.co/u/robymemo)\
**Post date:** [June 20, 2019, 5:18am UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/3 "2019-06-20T05:18:51Z")

</div>

Harvests see the paths, but process only the first one.  
The second folder have chmod 777

---

<div class="post-metadata">

**Author:** ![Izek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/izek/32/37113_2.png) [@Izek](https://discuss.elastic.co/u/Izek)\
**Post date:** [June 20, 2019, 8:14am UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/4 "2019-06-20T08:14:20Z")

</div>

paths:  
- /var/log/test.log  
- /var/log/temp\_tst/\*.log

should work

---

<div class="post-metadata">

**Author:** ![robymemo](https://avatars.discourse-cdn.com/v4/letter/r/82dd89/32.png) [@robymemo](https://discuss.elastic.co/u/robymemo)\
**Post date:** [June 20, 2019, 8:33am UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/5 "2019-06-20T08:33:07Z")

</div>

was a problem during the paste of conf file ... this is mine :

filebeat.inputs:  
-type: log  
paths:  
-/var/log/test.log  
-/var/log/temp\_tst/\*.log

---

<div class="post-metadata">

**Author:** ![Izek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/izek/32/37113_2.png) [@Izek](https://discuss.elastic.co/u/Izek)\
**Post date:** [June 20, 2019, 8:45am UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/6 "2019-06-20T08:45:28Z")

</div>

You need to follow the YAML format.  
below is my example

```auto
filebeat.prospectors:
- type: log
  enabled: true
  paths:
    - L:\IISLogs\W3SVC*\*
    - M:\IISLogs\W3SVC*\*

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 18, 2019, 10:45am UTC](https://discuss.elastic.co/t/different-files-to-same-index/186553/7 "2019-07-18T10:45:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.