# Filebeat is reading my logs but they stop to write on their files

**URL:** <https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 14, 2015, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132 "2015-12-14T14:13:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![adsqueiroz](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@adsqueiroz](https://discuss.elastic.co/u/adsqueiroz)\
**Post date:** [December 14, 2015, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132/1 "2015-12-14T14:13:36Z")

</div>

Hi folks!

I'm new on FileBeat, Logstash and Elastiscsearch. I'm trying to implement in my work, but I'm having problem with FileBeat.

When I start the service from FileBeat, my logs are sent to Logstash, but the files for example:

```
/var/log/pfswf01.log
/var/log/pfswf02.log

```

stop being incremented.

I did searches, but I didn't find anything that stop it.

Could you help me understand, what I'm doing wrong?

Bellow follow my filebeat.yml:

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/pfswf01.log
        - /var/log/pfswf02.log
        - /var/log/pfswf03.log 
        - /var/log/pfswf04.log
      document_type: firewall
    - 
      paths:
        - /var/log/syslog-ng.log
      document_type: syslog
    - 
      paths:
        - "/mnt/helicon/Notif/*.Log"
      document_type: urlnotif
    - 
      paths:
        - "/mnt/florina_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/alpha_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/daribow_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/livia_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/cygni_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/euterpe_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/korell_LogIIS/logs/LogFiles/W3SVC1/*.log"
        - "/mnt/nexon_LogIIS/logs/LogFiles/W3SVC1/*.log" 
      document_type: iis
    -
       paths:
         - "/mnt/livia/*.Log"
         - "/mnt/rhea/*.Log"
         - "/mnt/cygni/*.Log"
         - "/mnt/sarip/*.Log"
         - "/mnt/euterpe/*.Log"
         - "/mnt/hesperos/*.Log"
         - "/mnt/daribow/*.Log"
         - "/mnt/florina/*.Log"
         - "/mnt/bonde/*.Log"
         - "/mnt/alpha/*.Log"
         - "/mnt/korell/*.Log"
         - "/mnt/vega/*.Log"
         - "/mnt/cinna/*.Log"
         - "/mnt/helicon/*.Log"
         - "/mnt/fomalhaut/*.Log"
         - "/mnt/gamma/*.Log"
         - "/mnt/ifni/*.Log"
         - "/mnt/nexon/*.Log"
       document_type: operadoras   
      
       spool_size: 1024
       idle_timeout: 5s
       input_type: log
       fields:
       level: debug
       review: 1
       tail_files: false   
       

output:

  logstash:
  
      hosts: ["10.1.1.112:5044"]
      index: filebeat

file:

   path: "/tmp/filebeaat"

   filename: filebeat

   rotate_every_kb: 10000

   number_of_files: 7

logging:

   to_syslog: false

   to_files: true

files:

    path: "/var/log"

    name: filebeat.log

    rotateeverybytes: 10485760 # = 10MB

    keepfiles: 7

    selectors: ["*"]
    level: error
```

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [December 14, 2015, 2:39pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132/2 "2015-12-14T14:39:05Z")

</div>

Is this happening only for the firewall logs (pfswf?) or for the mounted IIS logs as well. Curious, why didn't you use a wildcard when configuring the pfswf paths?

Also, what operating system and distribution is this on?

---

<div class="post-metadata">

**Author:** ![adsqueiroz](https://avatars.discourse-cdn.com/v4/letter/a/6de8d8/32.png) [@adsqueiroz](https://discuss.elastic.co/u/adsqueiroz)\
**Post date:** [December 14, 2015, 3:43pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132/3 "2015-12-14T15:43:55Z")

</div>

Hi Tudor,

thanks to reply.

After new tests I saw that the logs are being incremented.

If I have new issue, I back with news.

Thanks a lot for your attention.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-is-reading-my-logs-but-they-stop-to-write-on-their-files/37132/4 "2017-07-05T21:57:30Z")

</div>