# Filebeat not picking logs when run as service **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 18, 2017, 5:14pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632 "2017-07-18T17:14:22Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![pavanssetty](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavanssetty/32/25314_2.png) [@pavanssetty](https://discuss.elastic.co/u/pavanssetty)\ **Post date:** [July 18, 2017, 5:14pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/1 "2017-07-18T17:14:22Z")
I am using Filebeat 5.4 version on Windows Server 2012. When I run filebeat from PowerShell or Command Prompt it is shipping logs successfully to my logstash instance running on Command Prompt. But when I try installing it as a service, it is not shipping any logs to logstash as if it is not reading my filebeat.yml file. There is no message in logs that it is not able to locate the filebeat.yml file Here is the Path to execute from the service: C:\Program Files\Filebeat\filebeat.exe" -c "C:\Program Files\Filebeat\filebeat.yml" -path.home "C:\Program Files\Filebeat" -path.data "C:\Program Files\Filebeat\data" Below is the log when run as service: 2017-07-18T19:04:43+02:00 INFO Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs] 2017-07-18T19:04:43+02:00 INFO Setup Beat: filebeat; Version: 5.4.0 2017-07-18T19:04:43+02:00 INFO Max Retries set to: 3 2017-07-18T19:04:43+02:00 INFO Activated logstash as output plugin. 2017-07-18T19:04:43+02:00 INFO Publisher name: DEHEREMAP9769 2017-07-18T19:04:43+02:00 INFO Flush Interval set to: 1s 2017-07-18T19:04:43+02:00 INFO Max Bulk Size set to: 2048 2017-07-18T19:04:43+02:00 INFO filebeat start running. 2017-07-18T19:04:43+02:00 INFO Registry file set to: C:\Program Files\Filebeat\data\registry 2017-07-18T19:04:43+02:00 INFO Loading registrar data from C:\Program Files\Filebeat\data\registry 2017-07-18T19:04:43+02:00 INFO States Loaded from registrar: 3 2017-07-18T19:04:43+02:00 INFO Loading Prospectors: 1 2017-07-18T19:04:43+02:00 INFO Prospector with previous states loaded: 0 2017-07-18T19:04:43+02:00 INFO Starting prospector of type: log; id: 17893974800932756507 2017-07-18T19:04:43+02:00 INFO Loading and starting Prospectors completed. Enabled prospectors: 1 2017-07-18T19:04:43+02:00 INFO Metrics logging every 30s 2017-07-18T19:04:43+02:00 INFO Starting Registrar 2017-07-18T19:04:43+02:00 INFO Start sending events to output 2017-07-18T19:04:43+02:00 INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s I am not able to figure out what is missing here. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 19, 2017, 1:19am UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/2 "2017-07-19T01:19:57Z")
You could enable debug logging to see if this provides any more clues. Also please share your config file. ```auto > Stop-Service filebeat # Add "logging.level: debug" to the config file. > Start-Service filebeat ``` ---
**Author:** ![pavanssetty](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavanssetty/32/25314_2.png) [@pavanssetty](https://discuss.elastic.co/u/pavanssetty)\ **Post date:** [July 19, 2017, 12:25pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/3 "2017-07-19T12:25:25Z")
Here is the log now. IT looks like it is able to read the filebeat.yml file correctly, but not able to read the log files at the network path 2017-07-19T13:52:37+02:00 DBG Disable stderr logging 2017-07-19T13:52:37+02:00 INFO Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs] 2017-07-19T13:52:37+02:00 INFO Setup Beat: filebeat; Version: 5.4.0 2017-07-19T13:52:37+02:00 DBG Processors: 2017-07-19T13:52:37+02:00 DBG Initializing output plugins 2017-07-19T13:52:37+02:00 INFO Max Retries set to: 3 2017-07-19T13:52:37+02:00 INFO Activated logstash as output plugin. 2017-07-19T13:52:37+02:00 DBG Create output worker 2017-07-19T13:52:37+02:00 DBG No output is defined to store the topology. The server fields might not be filled. 2017-07-19T13:52:37+02:00 INFO Publisher name: DEHEREMAP9769 2017-07-19T13:52:37+02:00 INFO Flush Interval set to: 1s 2017-07-19T13:52:37+02:00 INFO Max Bulk Size set to: 2048 2017-07-19T13:52:37+02:00 DBG create bulk processing worker (interval=1s, bulk size=2048) 2017-07-19T13:52:37+02:00 INFO filebeat start running. 2017-07-19T13:52:37+02:00 INFO Registry file set to: C:\Program Files\Filebeat\data\registry 2017-07-19T13:52:37+02:00 INFO Loading registrar data from C:\Program Files\Filebeat\data\registry 2017-07-19T13:52:37+02:00 INFO States Loaded from registrar: 3 2017-07-19T13:52:37+02:00 INFO Loading Prospectors: 1 2017-07-19T13:52:37+02:00 DBG **_File Configs: [Z:\.nasuni\audit\\<\\>\\.csv]_** 2017-07-19T13:52:37+02:00 DBG exclude\_files: [] 2017-07-19T13:52:37+02:00 INFO Prospector with previous states loaded: 0 2017-07-19T13:52:37+02:00 INFO Starting prospector of type: log; id: 17893974800932756507 2017-07-19T13:52:37+02:00 INFO Loading and starting Prospectors completed. Enabled prospectors: 1 2017-07-19T13:52:37+02:00 INFO Metrics logging every 30s 2017-07-19T13:52:37+02:00 DBG Windows is interactive: false 2017-07-19T13:52:37+02:00 INFO Starting Registrar 2017-07-19T13:52:37+02:00 INFO Start sending events to output 2017-07-19T13:52:37+02:00 INFO Starting spooler: spool\_size: 2048; idle\_timeout: 5s 2017-07-19T13:52:37+02:00 DBG Start next scan My config file: filebeat.yml ```auto filebeat.prospectors: - input_type: log paths: - Z:\.nasuni\audit\<>\*\*.csv scan_frequency: 60s exclude_lines: [".*Internal.*"] output.logstash: # The Logstash hosts hosts: ["localhost:5044"] ``` ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 24, 2017, 6:59pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/4 "2017-07-24T18:59:34Z")
Are there any entries in the registry file (C:\Program Files\Filebeat\data\registry) for the csv files you are trying to monitor with Filebeat? In general we do not recommend using Filebeat with network mounts. [https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes](https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes) ---
**Author:** ![ogauchard](https://avatars.discourse-cdn.com/v4/letter/o/3da27b/32.png) [@ogauchard](https://discuss.elastic.co/u/ogauchard)\ **Post date:** [July 27, 2017, 3:06pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/5 "2017-07-27T15:06:08Z")
Sounds like the account used to run the windows service is not allowed to read target directory on network mount. ---
**Author:** ![pavanssetty](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pavanssetty/32/25314_2.png) [@pavanssetty](https://discuss.elastic.co/u/pavanssetty)\ **Post date:** [August 2, 2017, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/6 "2017-08-02T15:18:15Z")
Yes I was trying to read the directory using windows mount. Thank You for pointing it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 30, 2017, 3:18pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-logs-when-run-as-service/93632/7 "2017-08-30T15:18:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.