# Filebeat is not sending complete logs
**URL:** https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219
**Category:** Beats
**Tags:** filebeat
**Created:** [June 8, 2016, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219 "2016-06-08T13:46:07Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@sinwar](https://discuss.elastic.co/u/sinwar)
#### Post date: [June 8, 2016, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219/1 "2016-06-08T13:46:07Z")
I am using docker elk for logs and forwarding logs using filebeat but some logs were sent or some not?
my filebeat.yml -\> [https://ghostbin.com/paste/rrjeh](https://ghostbin.com/paste/rrjeh)
filebeat logs in debug mode -\> [https://ghostbin.com/paste/fm2om](https://ghostbin.com/paste/fm2om)
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 8, 2016, 3:21pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219/2 "2016-06-08T15:21:31Z")
Filebeat persists the state. So if you started filebeat in the past it only sends the new events. Looking at the log file during startup it finds a lot of files it has a state for it before.
Can you share some more details on which events / logs are not send or does the above already answer your question?
---
### Author:  [@sinwar](https://discuss.elastic.co/u/sinwar)
#### Post date: [June 10, 2016, 7:17am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219/3 "2016-06-10T07:17:10Z")
Thanks for quick response
So can you direct me how can I state the files again like. I want all the files to be stated again?
---
### Author:  [@sinwar](https://discuss.elastic.co/u/sinwar)
#### Post date: [June 10, 2016, 7:26am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219/4 "2016-06-10T07:26:15Z")
and in my elasticsearch log -
Failed to execute phase [query], all shards failed
at org.elasticsearch.action.search.AbstractSearchAsyncAction.onFirstPhaseResult(AbstractSearchAsyncAction.java:206)
at org.elasticsearch.action.search.AbstractSearchAsyncAction$1.onFailure(AbstractSearchAsyncAction.java:152)
at org.elasticsearch.action.ActionListenerResponseHandler.handleException(ActionListenerResponseHandler.java:46)
at org.elasticsearch.transport.TransportService$DirectResponseChannel.processException(TransportService.java:855)
at org.elasticsearch.transport.TransportService$DirectResponseChannel.sendResponse(TransportService.java:833)
at org.elasticsearch.transport.TransportService$4.onFailure(TransportService.java:387)
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:39)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at java.lang.Thread.run(Thread.java:745)
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [June 13, 2016, 7:08am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219/5 "2016-06-13T07:08:30Z")
If you want to reindex all files, you need to stop filebeat and then remove the registry\_file here. In your case it is found here: [https://ghostbin.com/paste/rrjeh#L164](https://ghostbin.com/paste/rrjeh#L164)
Not sure how the elasticsearch query is related to this?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 29, 2016, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-complete-logs/52219/6 "2016-06-29T13:47:19Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.