# Filebeat input and source files

**URL:** <https://discuss.elastic.co/t/filebeat-input-and-source-files/220115>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 20, 2020, 7:53am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115 "2020-02-20T07:53:15Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![skyluke.1987](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\
**Post date:** [February 20, 2020, 7:53am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/1 "2020-02-20T07:53:16Z")

</div>

Hi all,

I have been trying to getting data from the local server and also from a remote server within the same network. But how can I make sure data are coming in?

Is there a command to check which are the source files or list the files location ?? Please advise.

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [February 20, 2020, 11:35am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/2 "2020-02-20T11:35:31Z")

</div>

Hi @skyluke.1987,

In filebeat logs you can check that How many or which file is harvested by filebeat and also, you can get other information as well.

Log Location : /var/log/filebeat/

Br,  
Harsh Bajaj

---

<div class="post-metadata">

**Author:** ![skyluke.1987](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\
**Post date:** [February 21, 2020, 2:14am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/3 "2020-02-21T02:14:00Z")

</div>

Hi thanks for sharing, but my filebeat log file does not tell much and it stop recording after awhile event my filebeat still running normally.

Is there some command that can I use to list down?

Meanwhile can I check did I done the right thing this way :

```
 filebeat.inputs:
   - type: log
     enabled: true
     paths:
      - /var/ossec/logs/alerts/alerts.json
      - /var/log/nginx/*.json
      - /var/log/syslog
      - ip/var/log/nginx/error.log-*
      - ip/var/log/nginx/access.log-*
      - ip/etc/nginx/logs/*.access
      - ip/etc/nginx/logs/*.error
     scan_frequency: 10s
     json.keys_under_root: true

```

Currently I notice that my Filebeat is receiving and reading this file " log.file.path /var/log/messages" and when I go to the server and check, it does not provide much info. This could be the reason why my dashboard does not have sufficient data to display those graphs. Please advise how should I configure those logs. Thanks !!

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [February 24, 2020, 4:47am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/4 "2020-02-24T04:47:24Z")

</div>

Hi @skyluke.1987,

I would suggest you to enable the debug log in filebeat.yml file and restart filebeat service.

set below configuration in filebeat.yml file.  
`logging.level: debug`

Br,  
Harsh Bajaj

---

<div class="post-metadata">

**Author:** ![skyluke.1987](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\
**Post date:** [March 2, 2020, 8:12am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/5 "2020-03-02T08:12:53Z")

</div>

hi yes, I have enabled the debug mode. But when I go to log files, I cant see much details.

now the setting is :  
root root filebeat (file permissions)

Is it correct ?

---

<div class="post-metadata">

**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\
**Post date:** [March 9, 2020, 11:03am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/6 "2020-03-09T11:03:32Z")

</div>

Hi @skyluke.1987,

Have you restart the filebeat service after changing the log level ?

> [@skyluke.1987](#):
>
> now the setting is :  
> root root filebeat (file permissions)

I did't understand this. could you please explain a bit more?

Br,  
Harsh Bajaj

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2020, 11:03am UTC](https://discuss.elastic.co/t/filebeat-input-and-source-files/220115/7 "2020-04-06T11:03:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.