# Filebeat not getting new IIS events after initial load **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [October 25, 2018, 12:49pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002 "2018-10-25T12:49:39Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![rstasiunas](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rstasiunas](https://discuss.elastic.co/u/rstasiunas)\ **Post date:** [October 25, 2018, 12:49pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/1 "2018-10-25T12:49:39Z")
I'm trying to stream IIS advanced logs via Filebeat to Logstash -\> Elasticsearch. If I delete the registry files and restart filebeat it loads all of the data, but does not load any additional log lines after the initial read. I'm not using the actual IIS module since I'm sending to Logstash first for parsing purposes. My filebeat input is this: // - type: log // - 'c:\inetpub\logs\AdvancedLogs\*.log' // fields: // logtype: iis // fields\_under\_root: true Can someone tell me what I'm doing wrong? I'm running Filebeat 6.4.2 and Logstash/Elasticsearch 6.4.1. However this problem presented in previous versions as well. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [October 25, 2018, 1:09pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/2 "2018-10-25T13:09:41Z")
Hello @rstasiunas I think your input definition is not correct, it should contains an **enabled** field, I believe the following will work for you. ```auto - type: log enabled: true paths: - c:\inetpub\logs\AdvancedLogs*.log fields: logtype: iis ``` ---
**Author:** ![rstasiunas](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rstasiunas](https://discuss.elastic.co/u/rstasiunas)\ **Post date:** [October 25, 2018, 1:12pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/3 "2018-10-25T13:12:47Z")
Apologies, that line is included in my config. I got a little aggressive on the copy/paste. Updated config is below. ``` filebeat.inputs: - type: log enabled: true - 'c:\inetpub\logs\AdvancedLogs\*.log' fields: logtype: iis fields_under_root: true ``` ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [October 25, 2018, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/4 "2018-10-25T13:16:46Z")
Looking at your second config fragment I do not see anything wrong. Can you add the starting log when Filebeat is started in debug mode and is there any error in the log? ```auto ./filebeat -v -e -d "*" ``` ---
**Author:** ![rstasiunas](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rstasiunas](https://discuss.elastic.co/u/rstasiunas)\ **Post date:** [October 25, 2018, 1:29pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/5 "2018-10-25T13:29:12Z")
I do not see any errors in the log output. When restarting filebeat, it gets the latest events since the last restart, but nothing new while it's running. It appears it gets to the end of the file and then just stops sending more data. The process continues to run, it just does not send any new logs since it was started. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [October 25, 2018, 1:31pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/6 "2018-10-25T13:31:52Z")
@rstasiunas New events are still appended in the logs? There is not connection issues or timeout related messages in the logs? ---
**Author:** ![rstasiunas](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rstasiunas](https://discuss.elastic.co/u/rstasiunas)\ **Post date:** [October 25, 2018, 1:46pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/7 "2018-10-25T13:46:37Z")
That's correct. It updates the registry file with the latest changes when it's started and sends the latest information. However if new events are appended after the initial read, those appended events are not recognized until Filebeat is restarted. There are no connection or timeout messages in the debug/info log. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [October 25, 2018, 2:04pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/8 "2018-10-25T14:04:23Z")
Is there any errors message on the Logstash side? ---
**Author:** ![rstasiunas](https://avatars.discourse-cdn.com/v4/letter/r/74df32/32.png) [@rstasiunas](https://discuss.elastic.co/u/rstasiunas)\ **Post date:** [October 25, 2018, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/9 "2018-10-25T15:10:05Z")
None that I'm seeing. The Info level logs on the filebeat side shows the following: ``` 2018-10-25T11:07:31.481-0400 INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monito ring": {"metrics": {"beat":{"cpu":{"system":{"ticks":327},"total":{"ticks":779,"value":779},"user":{"ticks":452}},"info" :{"ephemeral_id":"4ea49c67-8a37-417c-9cef-ac681b6c3daf","uptime":{"ms":4980211}},"memstats":{"gc_next":4194304,"memory_a lloc":1743312,"memory_total":11593120,"rss":16384}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"co nfig":{"module":{"running":0}},"pipeline":{"clients":1,"events":{"active":1}}},"registrar":{"states":{"current":26}}}}} 2018-10-25T11:08:01.486-0400 INFO [monitoring] log/log.go:141 Non-zero metrics in the last 30s {"monito ring": {"metrics": {"beat":{"cpu":{"system":{"ticks":327},"total":{"ticks":779,"value":779},"user":{"ticks":452}},"info" :{"ephemeral_id":"4ea49c67-8a37-417c-9cef-ac681b6c3daf","uptime":{"ms":5010211}},"memstats":{"gc_next":4194304,"memory_a lloc":1792128,"memory_total":11641936}},"filebeat":{"harvester":{"open_files":0,"running":0}},"libbeat":{"config":{"modu le":{"running":0}},"pipeline":{"clients":1,"events":{"active":1}}},"registrar":{"states":{"current":26}}}}} ``` It's almost like it reaches the end of the file and then never captures the appended events or re-harvests the file to look for changes. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [October 26, 2018, 12:20pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/10 "2018-10-26T12:20:39Z")
If you start filebeat with `-e -d "harvester"` it will give you a lot more log debug. I am interested to know if FB is closing the log file in question and why it does that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 23, 2018, 12:29pm UTC](https://discuss.elastic.co/t/filebeat-not-getting-new-iis-events-after-initial-load/154002/11 "2018-11-23T12:29:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.