# Filebeat debug logging are not written

**URL:** <https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 9, 2020, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734 "2020-03-09T14:47:11Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Axl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/axl/32/45475_2.png) [@Axl](https://discuss.elastic.co/u/Axl)\
**Post date:** [March 9, 2020, 2:47pm UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/1 "2020-03-09T14:47:11Z")

</div>

Hi,  
I configured filebeat to write debug logs to `/var/log/filebeat` directory, but I haven't got anything in there...

This is my configuration file:

logging.level: debug  
logging.to\_files: true  
logging.files:  
path: /var/log/filebeat  
name: filebeat.log  
rotateeverybytes: 10485760 # = 10MB  
keepfiles: 7  
permissions: 0600

And in `/var/log/filebeat`, my latest log are from March 5 (we're on March 9)

```
-rw------- 1 root root 280 Mar 5 11:54 filebeat
-rw------- 1 root root 280 Mar 5 11:45 filebeat.1
-rw------- 1 root root 280 Mar 5 11:45 filebeat.2
-rw------- 1 root root 280 Mar 5 11:44 filebeat.3
-rw------- 1 root root 280 Mar 5 11:44 filebeat.4

```

And this is the content of `filebeat`:

```
|2020-03-05T11:54:07.317+0100|INFO|instance/beat.go:622|Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]|
|---|---|---|---|
|2020-03-05T11:54:07.317+0100|INFO|instance/beat.go:630|Beat ID: f505e637-ece6-4dc5-ad66-5f986536eae4|

```

Just in case, this is the longer version of my configuration file, in case I commented something really silly, but I can't see it ☹

```
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: debug

# Enable debug output for selected components. To enable all selectors use ["*"]
# Other available selectors are "beat", "publish", "service"
# Multiple selectors can be chained.
#logging.selectors: []

# Send all logging output to stderr. The default is false.
#logging.to_stderr: false

# Send all logging output to syslog. The default is false.
#logging.to_syslog: false

# Send all logging output to Windows Event Logs. The default is false.
#logging.to_eventlog: false

# If enabled, Filebeat periodically logs its internal metrics that have changed
# in the last period. For each metric that changed, the delta from the value at
# the beginning of the period is logged. Also, the total values for
# all non-zero internal metrics are logged on shutdown. The default is true.
#logging.metrics.enabled: true

# The period after which to log the internal metrics. The default is 30s.
#logging.metrics.period: 30s

# Logging to rotating files. Set logging.to_files to false to disable logging to
# files.
logging.to_files: true
logging.files:
  # Configure the path where the logs are written. The default is the logs directory
  # under the home path (the binary location).
  path: /var/log/filebeat

  # The name of the files where the logs are written to.
  name: filebeat.log

  # Configure log file size limit. If limit is reached, log file will be
  # automatically rotated
  rotateeverybytes: 10485760 # = 10MB

  # Number of rotated log files to keep. Oldest files will be deleted first.
  keepfiles: 7

  # The permissions mask to apply when rotating log files. The default value is 0600.
  # Must be a valid Unix-style file permissions mask expressed in octal notation.
  permissions: 0600

  # Enable log file rotation on time intervals in addition to size-based rotation.
  # Intervals must be at least 1s. Values of 1m, 1h, 24h, 7*24h, 30*24h, and 365*24h
  # are boundary-aligned with minutes, hours, days, weeks, months, and years as
  # reported by the local system clock. All other intervals are calculated from the
  # Unix epoch. Defaults to disabled.
  #interval: 0

  # Rotate existing logs on startup rather than appending to the existing
  # file. Defaults to true.
  # rotateonstartup: true

# Set to true to log messages in JSON format.
#logging.json: false
```

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 10, 2020, 8:27am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/2 "2020-03-10T08:27:50Z")

</div>

Hi,

> [@Axl](#):
>
> ```
> # Sets log level. The default log level is info.
> # Available log levels are: error, warning, info, debug logging.level: debug
> # Enable debug output for selected components. To enable all selectors use ["*"]
> # Other available selectors are "beat", "publish", "service" # Multiple selectors can be chained. 
> # logging.selectors: []
> 
> ```

Please enable any logging selectors to see DEBUG entries.

---

<div class="post-metadata">

**Author:** ![Axl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/axl/32/45475_2.png) [@Axl](https://discuss.elastic.co/u/Axl)\
**Post date:** [March 10, 2020, 8:44am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/3 "2020-03-10T08:44:05Z")

</div>

Good catch 🙂  
However, this is still not working fully : I do see the debug logs with `journalctl -f -u filebeat`, but they are not written to `/var/log/filebeat/filebeat`...

journalctl:

```
Mar 10 09:39:32 instance-39 filebeat[10008]: 2020-03-10T09:39:32.905+0100 DEBUG [registrar] registrar/registrar.go:356 Processing 1 events
Mar 10 09:39:32 instance-39 filebeat[10008]: 2020-03-10T09:39:32.905+0100 DEBUG [registrar] registrar/registrar.go:326 Registrar state updates processed. Count: 1
...

```

filebeat log file: last logs are from March 5:

```
# tail /var/log/filebeat/filebeat
2020-03-05T11:54:07.317+0100	INFO	instance/beat.go:622	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-03-05T11:54:07.317+0100	INFO	instance/beat.go:630	Beat ID: f505e637-ece6-4dc5-ad66-5f986536eae4
```

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 10, 2020, 8:53am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/4 "2020-03-10T08:53:58Z")

</div>

Could you please verify that you're using this config file? e.g. make a typo inside.

You can also use "\*" as debug selector to see all entries.

---

<div class="post-metadata">

**Author:** ![Axl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/axl/32/45475_2.png) [@Axl](https://discuss.elastic.co/u/Axl)\
**Post date:** [March 10, 2020, 9:26am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/5 "2020-03-10T09:26:59Z")

</div>

Yes I am...

**Typo** in `/etc/filebeat/filebeat.yml`:

```
filebeat.inputs:
- type: zzzzzzlog

```

filebeat **fails to start** (good):

```
Mar 10 10:14:40 instance-39 filebeat[10626]: Exiting: Error while initializing input: Error creating input. No such input type ex
Mar 10 10:14:40 instance-39 systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE

```

And, I am using selecting **all selectors** with `logging.selectors: ["*"]`

I **changed the name of my logfile** , to test, and it still does not appear ☹

```
logging.level: debug
logging.selectors: ["*"]
logging.to_files: true
logging.files:
  # Configure the path where the logs are written. The default is the logs directory
  # under the home path (the binary location).
  path: /var/log/filebeat

  # The name of the files where the logs are written to.
  name: mylogfile-beat

```

I still have no `mylogfile-beat` in `/var/log/filebeat` ☹

```
# ls -al /var/log/filebeat
total 28
drwx------ 2 root root 4096 Mar 5 11:54 .
drwxr-xr-x 13 root root 4096 Mar 10 00:00 ..
-rw------- 1 root root 280 Mar 5 11:54 filebeat
-rw------- 1 root root 280 Mar 5 11:45 filebeat.1
-rw------- 1 root root 280 Mar 5 11:45 filebeat.2
-rw------- 1 root root 280 Mar 5 11:44 filebeat.3
-rw------- 1 root root 280 Mar 5 11:44 filebeat.4

```

Could it be an issue with **rights** to write in `/var/log/filebeat`? But I can't see why, I'm root, and filebeat is running as root...

I copy paste the entire `filebeat.yml` below in case I missed something:

```
######################## Filebeat Configuration ############################

# This file is a full configuration example documenting all non-deprecated
# options in comments. For a shorter configuration example, that contains only
# the most common options, please see filebeat.yml in the same directory.
#
# You can find the full configuration reference here:
# https://www.elastic.co/guide/en/beats/filebeat/index.html

#========================== Modules configuration =============================
filebeat.modules:

#=========================== Filebeat inputs =============================

# List of inputs to fetch data.
filebeat.inputs:
# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.
# Type of the files. Based on this the way the file is read is decided.
# The different types cannot be mixed in one input
#
# Possible options are:
# * log: Reads every line of the log file (default)
# * stdin: Reads the standard in

#------------------------------ Log input --------------------------------
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  # To fetch all ".log" files from a specific level of subdirectories
  # /var/log/*/*.log can be used.
  # For each file found under this path, a harvester is started.
  # Make sure not file is defined twice as this can lead to unexpected behaviour.
  paths:
    - /home/axelle/cowrie/var/log/cowrie/cowrie.json*

    #- c:\programdata\elasticsearch\logs\*

  # Configure the file encoding for reading files with international characters
  # following the W3C recommendation for HTML5 (http://www.w3.org/TR/encoding).
  # Some sample encodings:
  # plain, utf-8, utf-16be-bom, utf-16be, utf-16le, big5, gb18030, gbk,
  # hz-gb-2312, euc-kr, euc-jp, iso-2022-jp, shift-jis, ...
  encoding: plain

#========================== Filebeat autodiscover ==============================

#========================= Filebeat global options ============================

# Enable filebeat config reloading
filebeat.config:
  #inputs:
    #enabled: false
    #path: inputs.d/*.yml
    #reload.enabled: true
    #reload.period: 10s
  modules:
    enabled: true
    path: modules.d/*.yml
    #reload.enabled: true
    #reload.period: 10s

#================================ General ======================================

#================================ Processors ===================================

#============================= Elastic Cloud ==================================

#================================ Outputs ======================================

# Configure what output to use when sending the data collected by the beat.

#-------------------------- Elasticsearch output -------------------------------

#----------------------------- Logstash output ---------------------------------
output.logstash:
  # Boolean flag to enable or disable the output module.
  enabled: true

  # The Logstash hosts
  hosts: ["localhost:5044"]

  # Number of workers per Logstash host.
  worker: 1

  # Set gzip compression level.
  #compression_level: 3

  # Configure escaping HTML symbols in strings.
  #escape_html: false

  # Optional index name. The default index name is set to filebeat
  # in all lowercase.
  #index: 'filebeat'

#== Templates

# Enable JSON template loading. If this is enabled, the fields.yml is ignored.
#setup.template.json.enabled: false

# Path to the JSON template file
#setup.template.json.path: "${path.config}/template.json"

# Name under which the template is stored in Elasticsearch
#setup.template.json.name: ""

# Overwrite existing template
#setup.template.overwrite: false

# Elasticsearch template settings
setup.template.settings:

  # A dictionary of settings to place into the settings.index dictionary
  # of the Elasticsearch template. For more details, please check
  # https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping.html
  #index:
    #number_of_shards: 1
    #codec: best_compression
    #number_of_routing_shards: 30

  # A dictionary of settings for the _source field. For more details, please check
  # https://www.elastic.co/guide/en/elasticsearch/reference/current/mapping-source-field.html
  #_source:
    #enabled: false

#============================== Kibana =====================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  #host: "localhost:5601"

  # Optional protocol and basic auth credentials.
  #protocol: "https"
  #username: "elastic"
  #password: "changeme"

  # Optional HTTP path
  #path: ""

  # Use SSL settings for HTTPS. Default is true.
  #ssl.enabled: true

  # Configure SSL verification mode. If `none` is configured, all server hosts
  # and certificates will be accepted. In this mode, SSL based connections are
  # susceptible to man-in-the-middle attacks. Use only for testing. Default is
  # `full`.
  #ssl.verification_mode: full

  # List of supported/valid TLS versions. By default all TLS versions from 1.1
  # up to 1.3 are enabled.
  #ssl.supported_protocols: [TLSv1.1, TLSv1.2, TLSv1.3]

  # SSL configuration. The default is off.
  # List of root certificates for HTTPS server verifications
  #ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]

  # Certificate for SSL client authentication
  #ssl.certificate: "/etc/pki/client/cert.pem"

  # Client certificate key
  #ssl.key: "/etc/pki/client/cert.key"

  # Optional passphrase for decrypting the certificate key.
  #ssl.key_passphrase: ''

  # Configure cipher suites to be used for SSL connections
  #ssl.cipher_suites: []

  # Configure curve types for ECDHE-based cipher suites
  #ssl.curve_types: []

#================================ Logging ======================================
# There are four options for the log output: file, stderr, syslog, eventlog
# The file output is the default.

# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
logging.level: debug

# Enable debug output for selected components. To enable all selectors use ["*"]
# Other available selectors are "beat", "publish", "service"
# Multiple selectors can be chained.
logging.selectors: ["*"]

# Send all logging output to stderr. The default is false.
#logging.to_stderr: false

# Send all logging output to syslog. The default is false.
#logging.to_syslog: false

# Send all logging output to Windows Event Logs. The default is false.
#logging.to_eventlog: false

# If enabled, Filebeat periodically logs its internal metrics that have changed
# in the last period. For each metric that changed, the delta from the value at
# the beginning of the period is logged. Also, the total values for
# all non-zero internal metrics are logged on shutdown. The default is true.
#logging.metrics.enabled: true

# The period after which to log the internal metrics. The default is 30s.
#logging.metrics.period: 30s

# Logging to rotating files. Set logging.to_files to false to disable logging to
# files.
logging.to_files: true
logging.files:
  # Configure the path where the logs are written. The default is the logs directory
  # under the home path (the binary location).
  path: /var/log/filebeat

  # The name of the files where the logs are written to.
  name: mylogfile-beat

  # Configure log file size limit. If limit is reached, log file will be
  # automatically rotated
  rotateeverybytes: 10485760 # = 10MB

  # Number of rotated log files to keep. Oldest files will be deleted first.
  keepfiles: 7

  # The permissions mask to apply when rotating log files. The default value is 0600.
  # Must be a valid Unix-style file permissions mask expressed in octal notation.
  permissions: 0600

  # Enable log file rotation on time intervals in addition to size-based rotation.
  # Intervals must be at least 1s. Values of 1m, 1h, 24h, 7*24h, 30*24h, and 365*24h
  # are boundary-aligned with minutes, hours, days, weeks, months, and years as
  # reported by the local system clock. All other intervals are calculated from the
  # Unix epoch. Defaults to disabled.
  #interval: 0

  # Rotate existing logs on startup rather than appending to the existing
  # file. Defaults to true.
  # rotateonstartup: true

# Set to true to log messages in JSON format.
#logging.json: false

#============================== X-Pack Monitoring ===============================

#================================ HTTP Endpoint ======================================
# Each beat can expose internal metrics through a HTTP endpoint. For security
# reasons the endpoint is disabled by default. This feature is currently experimental.
# Stats can be access through http://localhost:5066/stats . For pretty JSON output
# append ?pretty to the URL.

#============================= Process Security ================================

#================================= Migration ==================================

# This allows to enable 6.7 migration aliases
#migration.6_to_7.enabled: false

```

Thanks!

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 10, 2020, 9:34am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/6 "2020-03-10T09:34:58Z")

</div>

I verified your filebeat.yml in my environment and it's correct (created files, filled up with logs). Could you please try with a different directory?

---

<div class="post-metadata">

**Author:** ![Axl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/axl/32/45475_2.png) [@Axl](https://discuss.elastic.co/u/Axl)\
**Post date:** [March 10, 2020, 9:52am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/7 "2020-03-10T09:52:38Z")

</div>

That's so strange then. I changed to `/var/log/myfilebeat`. Restarted the service.

```
logging.to_files: true
logging.files:
  # Configure the path where the logs are written. The default is the logs directory
  # under the home path (the binary location).
  path: /var/log/myfilebeat

  # The name of the files where the logs are written to.
  name: mylogfile-beat

```

And I have no `/var/log/myfilebeat` directory ☹

```
# ls /var/log/myfilebeat
ls: cannot access '/var/log/myfilebeat': No such file or directory

```

The journal sees nothing concerning `myfilebeat`.

`# journalctl -u filebeat | grep "myfilebeat"`

But it continues to mention `/var/log/filebeat`:

```
# journalctl -u filebeat | grep "/var/log/filebeat"
      Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "f505e637-ece6-4dc5-ad66-5f986536eae4"}}}
Mar 10 10:50:19 instance-39 filebeat[11321]: 2020-03-10T10:50:19.306+0100 INFO instance/beat.go:622 Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
Mar 10 10:50:19 instance-39 filebeat[11321]: 2020-03-10T10:50:19.306+0100 INFO [beat] instance/beat.go:958 Beat info {"system_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "f505e637-ece6-4dc5-ad66-5f986536eae4"}}}

```

Damn it! I'm going to scratch the file, and start again from the `filebeat.reference.yml` ☹

---

<div class="post-metadata">

**Author:** ![Axl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/axl/32/45475_2.png) [@Axl](https://discuss.elastic.co/u/Axl)\
**Post date:** [March 10, 2020, 10:44am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/8 "2020-03-10T10:44:23Z")

</div>

I started from scratch using `filebeat.reference.yml`. It works better, but I have very few logs, I would have expected far more given the fact I selected all debug logs.

My filebeat.yml config file uses no filebeat.modules, one filebeat.inputs (reading data from Cowrie - a honeypot), and logs are set to debug, in `/var/log/filebeat` dir. The only thing I changed (as far as I know) compared with my previous configuration, is that I set `interval: 24h`. Maybe it needed an interval to actually start and log?

So, this is what I have in the log dir:

```
# ls -al
total 40
drwx------ 2 root root 4096 Mar 10 11:07 .
drwxr-xr-x 13 root root 4096 Mar 10 00:00 ..
-rw------- 1 root root 391 Mar 10 11:07 filebeat
-rw------- 1 root root 280 Mar 5 11:45 filebeat.1
-rw------- 1 root root 280 Mar 5 11:45 filebeat.2
-rw------- 1 root root 280 Mar 5 11:54 filebeat-2020-03-05-1
-rw------- 1 root root 391 Mar 10 11:05 filebeat-2020-03-10-1
-rw------- 1 root root 570 Mar 10 11:07 filebeat-2020-03-10-2
-rw------- 1 root root 280 Mar 5 11:44 filebeat.3
-rw------- 1 root root 280 Mar 5 11:44 filebeat.4

```

I am surprised that `filebeat` has so little information:

```
# cat filebeat
2020-03-10T11:07:14.836+0100	INFO	instance/beat.go:622	Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]
2020-03-10T11:07:14.836+0100	DEBUG	[beat]	instance/beat.go:674	Beat metadata path: /var/lib/filebeat/meta.json
2020-03-10T11:07:14.836+0100	INFO	instance/beat.go:630	Beat ID: f505e637-ece6-4dc5-ad66-5f986536eae4

```

I have far more debug message in `journalctl`. Is it normal I don't get those in `/var/log/filebeat/filebeat`?

```
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:511    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:563    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:421    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:511    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:565    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:421    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:511    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:565    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:421    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:511    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:565    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:421    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:511    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:565    
Mar 10 11:43:56 instance-39 filebeat[11727]: 2020-03-10T11:43:56.168+0100 DEBUG [input] log/input.go:212    
Mar 10 11:43:57 instance-39 filebeat[11727]: 2020-03-10T11:43:57.148+0100 DEBUG [harvester] log/log.go:107
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2020, 10:44am UTC](https://discuss.elastic.co/t/filebeat-debug-logging-are-not-written/222734/9 "2020-04-07T10:44:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.