# Filebeat has to be restarted to send logs to elasticsearch
**URL:** https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330
**Category:** Beats
**Tags:** filebeat
**Created:** [May 27, 2017, 9:06am UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330 "2017-05-27T09:06:06Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)
#### Post date: [May 27, 2017, 9:06am UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/1 "2017-05-27T09:06:06Z")
I can see that logs are added only after i restart filebeat in client machine. Everytime I have to restart to get the logs updated. Need help in figuring out where the fault is.
Thanks in advance.
---
### Author:  [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)
#### Post date: [May 27, 2017, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/2 "2017-05-27T13:23:08Z")
UPDATE : with scan\_frequency set im able to update logs dynamically. But the process is very slow. Is there a way to find out how fast logstash is sending files to elastic search?
---
### Author:  [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [May 27, 2017, 5:50pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/3 "2017-05-27T17:50:04Z")
Can you please share your filebeat configuration and log file (if possible)?
---
### Author:  [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)
#### Post date: [May 27, 2017, 6:04pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/4 "2017-05-27T18:04:29Z")
filebeat.prospectors:
- input\_type: log
output.logstash:
hosts: ["[logstash.computenext.com:5443](http://logstash.computenext.com:5443)"]
bulk\_max\_size: 2048
ssl.certificate\_authorities: ["/etc/filebeat/logstash.crt"]
[template.name](http://template.name): "filebeat"
template.path: "filebeat.template.json"
template.overwrite: false
This is my filebeat config file.
Is there anything that i can do to my filebeat.yml to speed up the process?
sorry for the format. I am new here.
---
### Author:  [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [May 27, 2017, 6:44pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/5 "2017-05-27T18:44:46Z")
The `scan_frequency` setting is for configuring how fast filebeat picks up _new logs files_. Your configuration is set to read fixed log files only, so the `scan_frequency` should have effect here.
Also, those `template.*` settings are not valid logstash output settings. This should not be causing any problem, but I recommend to remove it.
Lastly, besides the issue above, I don't see any other issue with your configuration that could be causing what you are reporting. If you share the filebeat logs maybe we can find out other issues.
---
### Author:  [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)
#### Post date: [May 27, 2017, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/6 "2017-05-27T18:59:19Z")
Well that had some effect. I reduced the scan\_frequency and it doubled the thoroughput. Thanks for the help @thiago.
If possible have a look at another issue that i've been facing. Here is the link
[Filebeat in windows is unable to send logs to logstash in Ubuntu server](https://discuss.elastic.co/t/filebeat-in-windows/87344)
Thanks in advance.
---
### Author:  [@thiago](https://discuss.elastic.co/u/thiago)
#### Post date: [May 27, 2017, 7:05pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/7 "2017-05-27T19:05:03Z")
I am glad that your problem is solved but keep in mind that the setting `scan_frequency` does _not_ configures how fast a log file is read. Also setting `scan_frequency` to less then `1s` is _not_ recommended.
I strongly recommend that you read the [documentation about `scan_frequency` setting](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#scan-frequency)
---
### Author:  [@sasanka\_mourya](https://discuss.elastic.co/u/sasanka_mourya)
#### Post date: [May 27, 2017, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/8 "2017-05-27T19:10:21Z")
Getting the double throughput must be because of restarting filebeat. I've just read what is there in your link and found that i can use close\_inactive to get the logs close to real time. Thanks a lot @thiago.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 24, 2017, 7:10pm UTC](https://discuss.elastic.co/t/filebeat-has-to-be-restarted-to-send-logs-to-elasticsearch/87330/9 "2017-06-24T19:10:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.