# Filebeat iis enabled. error is disabled but still looking for the http error file

**URL:** <https://discuss.elastic.co/t/filebeat-iis-enabled-error-is-disabled-but-still-looking-for-the-http-error-file/142002>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 27, 2018, 10:19pm UTC](https://discuss.elastic.co/t/filebeat-iis-enabled-error-is-disabled-but-still-looking-for-the-http-error-file/142002 "2018-07-27T22:19:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shani\_angarkadu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shani_angarkadu/32/50638_2.png) [@shani\_angarkadu](https://discuss.elastic.co/u/shani_angarkadu)\
**Post date:** [July 27, 2018, 10:19pm UTC](https://discuss.elastic.co/t/filebeat-iis-enabled-error-is-disabled-but-still-looking-for-the-http-error-file/142002/1 "2018-07-27T22:19:48Z")

</div>

IIS module enabled and given a specific path for accesss file, but still it is going to default file and also error enabled to false but it is looking for HttpError files.

```auto
filebeat.modules:
- module: iis
  # Access logs
  access:
    enabled: true
    var.paths: ["C:/Users/sairam/Downloads/ELK2/filebeat-6.3.2/iis1/*.LOG"]

  # Error logs
  error:
    enabled: false

```

2018-07-27T18:18:55.572-0400 ERROR log/input.go:460 Harvester could not be started on new file: c:\Windows\System32\LogFiles\HTTPERR\httperr1.log, Err: Error setting up harvester: Harvester setup failed. Unexpected file opening error: Failed opening c:\Windows\System32\LogFiles\HTTPERR\httperr1.log: Error creating file '%!s(\*uint16=0xc0423910a0)': Access is denied.

---

<div class="post-metadata">

**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\
**Post date:** [July 30, 2018, 7:47am UTC](https://discuss.elastic.co/t/filebeat-iis-enabled-error-is-disabled-but-still-looking-for-the-http-error-file/142002/2 "2018-07-30T07:47:03Z")

</div>

Hi,

Enclose your configuration in triple-backticks

```  
like this  
```

so it's indentation can be checked.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 7:47am UTC](https://discuss.elastic.co/t/filebeat-iis-enabled-error-is-disabled-but-still-looking-for-the-http-error-file/142002/3 "2018-08-27T07:47:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.