# Filebeat configuration option 'tail\_files' **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 1, 2016, 7:46am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084 "2016-03-01T07:46:51Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Augustin\_Chen](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Post date:** [March 1, 2016, 7:46am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/1 "2016-03-01T07:46:51Z")
I am working on the filebeat 1.1.1. The following is the snippet of the configuation file. I assume the filebeat reads from the end of the log files as the 'tail\_files' is true. But it seems the filebeat doesn't work as I thought. Any idea of this? ```auto filebeat: prospectors: - paths: - "/var/log/nginx/*access.log" document_type: "nginx_access" exclude_files: [".tar$",".tgz$",".gz$",".bz2$",".zip$"] tail_files: true force_close_files: true ``` ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 1, 2016, 8:04am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/2 "2016-03-01T08:04:52Z")
Can you give some more details on what is happening? What exactly does not work as expected? Side note: I added code formatting in your post above to make it better readable ---
**Author:** ![Augustin\_Chen](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Post date:** [March 1, 2016, 8:30am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/3 "2016-03-01T08:30:08Z")
The access.log is 30 days old, when I start the filebeat for the first time, I notice the filebeat read all the lines of the log file. I assume the filebeat reads the only new lines that are created after the filebeat is started. ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [March 1, 2016, 1:10pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/4 "2016-03-01T13:10:08Z")
That is indeed not expected. Could it be that you started filebeat before without having tail\_files set and that a registrar file was generated? Can you do the following? - Stop filebeat - Remove the registry file - Start filebeat with the `-e -d "*"` option Please provide the the output from your console here. ---
**Author:** ![Augustin\_Chen](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Post date:** [March 2, 2016, 7:41am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/5 "2016-03-02T07:41:24Z")
Hi ruflin, You are right, I start the filebeat with tailf\_files set before. I make a test in another server which doesn't have filebeat installed before. The filebeat read from end the of log file as I expect. Thank you. ---
**Author:** ![taylor](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@taylor](https://discuss.elastic.co/u/taylor)\ **Post date:** [May 25, 2016, 9:26pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/6 "2016-05-25T21:26:21Z")
I cannot get the tail feature to work on linux - i've tried removing the .filebeat registry file and restarting with tail option = true . It doesn't read the log entries a i enter them . - I have run with the -e -d "\*" options, I see a lot of "not harvesting, file didnt change" even though i'm entering lines into the log. ---
**Author:** ![taylor](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@taylor](https://discuss.elastic.co/u/taylor)\ **Post date:** [May 25, 2016, 11:04pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/7 "2016-05-25T23:04:35Z")
I cannot get the tail feature to work on linux - i've tried removing the .filebeat registry file and restarting with tail option = true . It doesn't read the log entries a i enter them . - I have run with the -e -d "\*" options, I see a lot of "not harvesting, file didnt change" even though i'm entering lines into the log. if i set tail : false, it reads the entire file again each time i enter a new line in my log file ( including my new line ). That is not the normal behaviour is it ? 9 to re read the entire log file ). ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 26, 2016, 9:00am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/8 "2016-05-26T09:00:46Z")
What commands do you use to write into your log file? ---
**Author:** ![taylor](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@taylor](https://discuss.elastic.co/u/taylor)\ **Post date:** [May 26, 2016, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/9 "2016-05-26T13:47:57Z")
I'm just using the vi editor to enter lines in the log file. Here is more detail - 1. i installed filebeat-1.2.3-x86\_64 from filebeat-1.2.3-x86\_64.tar.gz using tar xvf cmd 2. i entered the following in filebeat.yml paths : - /sandbox/logs/travels.log encoding : plain input\_type : log tail : true 3. start filebeat with ./filebeat -e -d "\*" 4. enter lines into travels.log with the vi command 5. view logstash to see if log lines make it to logstash ( they do not ). Thanks for you help ! FF ---
**Author:** ![taylor](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@taylor](https://discuss.elastic.co/u/taylor)\ **Post date:** [May 26, 2016, 2:12pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/10 "2016-05-26T14:12:02Z")
additionally, I have tried turning tail off ( tail : false ) and restarting, i see the log does pick up the initial lines, but subsequent new lines do not seem to get picked up. 1. stopped filebeat 2. removed .filebeat 3. entered tail : false in filebeat.yml 4. restart with filebeat -e -d "\*" 5. stop filebeat 6. remove .filebeat 7. entered tail : true in filebeat.yml 8. restart filebeat with ./filebeat -e -d "\*" 9. enter log line via vi command I see initial log entries are picked up. new lines ( entered using vi ) are not picked up ---
**Author:** ![taylor](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@taylor](https://discuss.elastic.co/u/taylor)\ **Post date:** [May 26, 2016, 3:23pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/11 "2016-05-26T15:23:49Z")
what are the steps to get a file reading from the tail - starting from initial installation ? ---
**Author:** ![taylor](https://avatars.discourse-cdn.com/v4/letter/t/c2a13f/32.png) [@taylor](https://discuss.elastic.co/u/taylor)\ **Post date:** [May 26, 2016, 3:59pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/12 "2016-05-26T15:59:55Z")
i figured out the issue - the elastic search output in filebeat.yml was uncommented - therefore it was attempting to use both elasticsearch and logstash as outputs. i commneted out the elasticsearch section and all is working fine now ! ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [May 30, 2016, 8:29am UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/13 "2016-05-30T08:29:24Z")
Glad to hear you found the solution yourself. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:51pm UTC](https://discuss.elastic.co/t/filebeat-configuration-option-tail-files/43084/14 "2017-07-05T21:51:25Z")