# Difficulties with external configs in FileBeat

**URL:** <https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 20, 2018, 11:25am UTC](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863 "2018-04-20T11:25:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [April 20, 2018, 11:25am UTC](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863/1 "2018-04-20T11:25:35Z")

</div>

I have a working filebeat (6.2.2) configuration but am missing the ability to change the config (during development) and have filebeat pick up the changes without being restarted. As I understand it, this is only possible with external configuration files but I have not been able to find any example of how such .yml files should look - at least only conflicting examples and no working examples.

Just copying my `- type` sections into an external .yml file has not done the trick.

my filebeat.yml :

```
filebeat.prospectors:
  # -type sections were here...
  enabled: true
  path: D:\elk\filebeat\config\*_dev.yml

```

D:\elk\filebeat\config\filebeat\_access\_dev.yml :

```
# Parse apache tomcat "access" log
- type: log
  enabled: true
  paths:
	- D:\tmp\log\access.*.log
  # We exclude redirects, pings and health checks, JavaScripts and CSS
  exclude_lines: [' 302 ', 'UptimeRobot', 'healthCheck', '_ui/', '\.js', '\.css']
  fields:
	source: access
	server: app02
  scan_frequency: 3s

```

Needless to say, filebeat does not monitor changes to files in `D:\tmp\log\access.*.log`. It also does not log anything relating to `D:\elk\filebeat\config\*_dev.yml` and only mentions scanning for modules in `./modules.d/*.yml`

> 2018-04-20T13:20:10.683+0200 INFO crawler/crawler.go:82 Loading and starting Prospectors completed. Enabled prospectors: 0

Filebeat also does not seem to raise any error or info logs (even using `-v` or `-d *`) if the .yml files are incorrectly structured or the the scan path does not exist!

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 20, 2018, 1:21pm UTC](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863/2 "2018-04-20T13:21:58Z")

</div>

Filebeat uses YAML for it's configuration. A `:` e.g. might not be parsed into a string, but a dictionary. On windows always put paths into single quotes (single quotes don't interpret the `\` as escape character): `'D:\tmp\log\access.*.log`.

Have you checked cases of paths? Unfortunately the glob used by filebeat is case-sensitive.

According to [filebeat docs on external loading](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html), the external loading is configured via `filebeat.config.prospectors`, not `filebeat.prospectors`.

---

<div class="post-metadata">

**Author:** ![cawoodm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cawoodm/32/14083_2.png) [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Post date:** [April 23, 2018, 8:13am UTC](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863/3 "2018-04-23T08:13:11Z")

</div>

I've not had a problem before with unquoted paths e.g.:

```
path.data: D:\elk\filebeat\data_dev

```

However you are right about `filebeat.config.prospectors` - that has solved it for me thanks!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2018, 8:13am UTC](https://discuss.elastic.co/t/difficulties-with-external-configs-in-filebeat/128863/4 "2018-05-21T08:13:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.