# Filebeat not monitoring data **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 19, 2016, 5:38am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500 "2016-01-19T05:38:38Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![usahitya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usahitya/32/6180_2.png) [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Post date:** [January 19, 2016, 5:38am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/1 "2016-01-19T05:38:38Z")
Hi Friends, I set up Elasticsearch in our Lab, there in filebeat.yml I given the following configuration filebeat: paths: - /var/log/\* document\_type: syslog **scan\_frequency: 10s** logstash: # The Logstash hosts hosts: ["_._._._:5044"] even though Scan\_frequency:10s, Filebeat is not Monitoring files. It just Adding the files at very first time when it see new file path is given. Could anyone help me to sort it out. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 19, 2016, 7:15am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/2 "2016-01-19T07:15:44Z")
Please post full logs, i.e. start Filebeat with `-v -d "*"`. (I suspect `-v` is superfluous when `-d` is specified but it won't hurt.) ---
**Author:** ![usahitya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usahitya/32/6180_2.png) [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Post date:** [January 19, 2016, 7:32am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/3 "2016-01-19T07:32:12Z")
Hi Magnus, Please find the below lines are in my Filebeat.yml file. filebeat: prospectors: paths: - /var/log/\* type: log paths: - /var/log/cron type: cron\_log document\_type: syslog scan\_frequency: 10s output: elasticsearch: hosts: ["localhost:9200"] logstash: hosts: ["ip\_add:5044"] // here output as Logstash shipper: logging: files: this is total file , means remaining all lines contains # front of them. File is adding, I can discover through kibana. but, later changes in files are not monitoring by Filebeat. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 19, 2016, 8:57am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/4 "2016-01-19T08:57:48Z")
I asked for _logs_, not your configuration (although it's good to have the full configuration, but please make sure you format it as code since YAML is indentation-sensitive and this forum strips leading whitespace). ---
**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\ **Post date:** [January 19, 2016, 10:55am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/5 "2016-01-19T10:55:46Z")
why have you configured both, elasticsearch and logstash output? This on purpose? ---
**Author:** ![usahitya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usahitya/32/6180_2.png) [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Post date:** [January 20, 2016, 5:28am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/6 "2016-01-20T05:28:25Z")
> [@magnusbaeck](#): > > superfluous Hi Magnus, I would like to monitor syslog. and I didn't found syslog so I given the path like, paths: - /var/log/\* in that folder all the below log files are there. problem is eventhough scan\_frequency is 10s , it is not monitoring. anaconda.log, audit, boot.log, btmp, cron, cups, dmesg, dracut.log, gdm, httpd, kern, maillog, mcelog, messages, mysqld.log, pm-powersave.log, sa-update.log, secure, spooler, tallylog, up2date, wtmp, Xorg.0.log, yum.log ---
**Author:** ![usahitya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/usahitya/32/6180_2.png) [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Post date:** [January 20, 2016, 5:41am UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/7 "2016-01-20T05:41:43Z")
Hi Steffens, there is no purpose for putting output both as elasticsearch and logstash. It is accidentally forget to comment one. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-not-monitoring-data/39500/8 "2017-07-05T21:56:35Z")