# Filebeat doesn't bring me all the logs i need

**URL:** <https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 11, 2020, 12:19pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698 "2020-06-11T12:19:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [June 11, 2020, 12:19pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698/1 "2020-06-11T12:19:16Z")

</div>

Hello,

I have filebeat and ELK version 7.7.0

I successfully enabled the Elasticsearch module of Filebeat and i can see server and gc logs now in kibana.

Nevertheless i cant see in kibana my gc, audit and deprecation logs.

My configuration and log path files are as the image show below;

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a0ff7535c34fc54f42c39612c838ff26999ee42.png)  
What am i doing wrong?  
Thank you

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 15, 2020, 11:37pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698/2 "2020-06-15T23:37:42Z")

</div>

Please don't post pictures of text, they are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [June 16, 2020, 6:44am UTC](https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698/3 "2020-06-16T06:44:07Z")

</div>

Hello Mark,

Thank you for the info 🙂 i also include now the content of my yaml file for elasticsearch module:

```
# Module: elasticsearch
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.7/filebeat-module-elasticsearch.html

- module: elasticsearch
  # Server log
  server:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
     - /var/log/elasticsearch/*_server.json

  gc:
    enabled: true
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  audit:
    enabled: true
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
     - /var/log/elasticsearch/*_audit.json

  slowlog:
    enabled: true
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
     - /var/log/elasticsearch/*_index_search_slowlog.json
     - /var/log/elasticsearch/*_index_indexing_slowlog.json

  deprecation:
    enabled: true
    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
     - /var/log/elasticsearch/*_deprecation.json

```

and the kind of logs that i have in the path: /var/log/elasticsearch

have the following names:

- SAG-TEST\_audit.json
- SAG-TEST\_audit.log
- SAG-TEST\_deprecation.json
- SAG-TEST\_deprecation.log
- SAG-TEST\_index\_indexing\_slowlog.json
- SAG-TEST\_index\_indexing\_slowlog.log
- SAG-TEST\_index\_search\_slowlog.json
- SAG-TEST\_index\_search\_slowlog.log
- SAG-TEST.log
- SAG-TEST\_server.json

Any help?

Thank you

---

<div class="post-metadata">

**Author:** ![Alexandros888](https://avatars.discourse-cdn.com/v4/letter/a/3ec8ea/32.png) [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Post date:** [June 22, 2020, 9:37am UTC](https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698/4 "2020-06-22T09:37:25Z")

</div>

Hello any possible news on that one ?

thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2020, 11:53am UTC](https://discuss.elastic.co/t/filebeat-doesnt-bring-me-all-the-logs-i-need/236698/5 "2020-07-20T11:53:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.