# Filebeat neither sending updated logs to AWS elastic search nor updating it's own logs

**URL:** <https://discuss.elastic.co/t/filebeat-neither-sending-updated-logs-to-aws-elastic-search-nor-updating-its-own-logs/184808>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 7, 2019, 7:17pm UTC](https://discuss.elastic.co/t/filebeat-neither-sending-updated-logs-to-aws-elastic-search-nor-updating-its-own-logs/184808 "2019-06-07T19:17:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shilpa0209](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shilpa0209/32/47741_2.png) [@shilpa0209](https://discuss.elastic.co/u/shilpa0209)\
**Post date:** [June 7, 2019, 7:17pm UTC](https://discuss.elastic.co/t/filebeat-neither-sending-updated-logs-to-aws-elastic-search-nor-updating-its-own-logs/184808/1 "2019-06-07T19:17:21Z")

</div>

I have configured filebeat(version 7.1.1) on my system to send logs to AWS Elastic Search but it is not doing following two things appropriately:

1. Updating it's own log file at `/var/log/filebeat`, and
2. Sending the updated logs from `/var/log/*logs` to AWS ES

_Issue 1_: When I run `sudo service filebeat restart` it does not update logs files. I tried running `filebeat -c /etc/filebeat/filebeat.yml` to update the log files. When I run this command the terminal hangs and I have to manually close the terminal and start a new session. Filebeat logs get updated after this.

_Issue 2_: The log files are sent only the first time and then it never gets updated. When I do `curl XGET aws_elasticsearch_domain` it only returns the logs sent for the first time.I checked the Kibana dashboard as well and it only has the logs from the first time.

As per my current `/var/log/filebeat/filebeat` log file the connection to ES was successful and the logs were send but I still cannot see the updated logs on Kibana or through `curl -XGET vpc-xxxxxxx.es.amazonaws.com/_search?pretty=true&q=*:*`.

**filebeat.yml**

```auto
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /var/log/*.log
  scan_frequency: 5s
  multiline.pattern: '^[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

setup.template.settings:
  index.number_of_shards: 1

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

output.elasticsearch:
  hosts: ["vpc-xxxxxxxxxx.es.amazonaws.com:80"]
  bulk_max_size: 2
  timeout: 180

setup.kibana:
  host: ["vpc-xxxxxxxxxxx.es.amazonaws.com:80"]
  path: /_plugin/kibana
```

---

<div class="post-metadata">

**Author:** ![Michael\_Madden](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michael_madden/32/46640_2.png) [@Michael\_Madden](https://discuss.elastic.co/u/Michael_Madden)\
**Post date:** [June 27, 2019, 6:56pm UTC](https://discuss.elastic.co/t/filebeat-neither-sending-updated-logs-to-aws-elastic-search-nor-updating-its-own-logs/184808/2 "2019-06-27T18:56:21Z")

</div>

Hello, thanks for reaching out. I'm curious what operating system is running on the system that has filebeat on it? I've seen issues with RHEL & CentOS 7.x where logs from beats end up in journald.

You may want to run the following command to see if logs are in journald.

`journalctl -u filebeat.service`

[https://www.elastic.co/guide/en/beats/filebeat/master/running-with-systemd.html](https://www.elastic.co/guide/en/beats/filebeat/master/running-with-systemd.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2019, 7:08pm UTC](https://discuss.elastic.co/t/filebeat-neither-sending-updated-logs-to-aws-elastic-search-nor-updating-its-own-logs/184808/3 "2019-07-25T19:08:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.