# Filebeat not ingesting json based log files to elastic search
**URL:** https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482
**Category:** Beats
**Tags:** filebeat
**Created:** [September 29, 2022, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482 "2022-09-29T16:48:25Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@paarbour](https://discuss.elastic.co/u/paarbour)
#### Post date: [September 29, 2022, 4:48pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482/1 "2022-09-29T16:48:26Z")
I have Elasticsearch and Kibana working, that was the easy part.
I can ingest files directly from Kibana, no problems they get parsed and handled without issue.
I am now trying to configure filebeat to pull in files from disk.
The logs seem to indicate no problem connecting to elasticsearch, and I can see an index for the filebeat connection to Kibana.
yellow open .ds-filebeat-8.4.2-2022.09.29-000001 vgkrXtxrQKalFguxA5r-Aw 1 1 229160 0 65.9mb 65.9mb
However the files are not being loaded by filebeat.
I can see that filebeat notices the log file:
`Sep 29 12:35:42 optimusprime filebeat[4182105]: {"log.level":"info","@timestamp":"2022-09-29T12:35:42.055-0400","log.logger":"input.filestream","log.origin":{"file.name":"filestream/input.go","file.line":321},"message":"Reader was closed. Closing.","service.name":"filebeat","id":"NPCStream","source_file":"filestream::NPCStream::native::536871118-64770","path":"/home/logs/xaa.log","state-id":"native::536871118-64770","ecs.version":"1.6.0"}`
but it never gets parsed and ingested.
I took some sample json items from the internet hoping it would help here but it didn't
```auto
# filestream is an input for collecting log messages from files.
- type: filestream
id: NPCStream
enabled: true
paths:
- /home/logs/*.log
json.keys_under_root: true
json.overwrite_keys: true
json.add_error_key: true
json.expand_keys: true
```
```auto
output.elasticsearch:
# Array of hosts to connect to.
hosts: ["localhost:9200"]
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [September 29, 2022, 10:34pm UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482/2 "2022-09-29T22:34:08Z")
Might be that file is already read and exist in the registry database.
Check /var/lib/filebeat. You can also set as a parameter: `filebeat.registry.path: registry`
If still is not working, change [logging](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html) to the debug mode.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 28, 2022, 12:34am UTC](https://discuss.elastic.co/t/filebeat-not-ingesting-json-based-log-files-to-elastic-search/315482/3 "2022-10-28T00:34:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.