# FileBeat not picking up the updated file asap

**URL:** <https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 8, 2016, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821 "2016-03-08T19:20:01Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 8, 2016, 7:20pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/1 "2016-03-08T19:20:01Z")

</div>

I have installed Elastic Search, FileBeat and Kibana on my Windows 7 machine.  
As of now my log path is C:\LogFiles\ and it contains 5 files(Log File 1.txt...2.txt....). I created it new and have some contents in it.  
I edited the yaml file to pick the logs from "- C:\LogFiles\*" and have set "input\_type: file". No more changes.

I started all the 3(ES, Kibana and FB) from Windows Services. When tried searching for a text in Kibana, no results where found.

Also, I edited the yaml file to pick the logs from "- C:\LogFiles\*" and have set "input\_type: log". Again no results.

What am I missing here ? Also, do I need to restart FB, ES or KB services if I have any changes to my log files?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 9, 2016, 9:34am UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/2 "2016-03-09T09:34:45Z")

</div>

`input_type:file` does not exist. What was your intention with this change?

Did you restart filebeat after config changes? You only need to restart filebeat if you change the config, not if files change.

I think also your path to pick up should be `C:\LogFiles\*`

To get some more information what happens, your filebeat with `-e -d "*"` and it will print out some more debugging information.

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 9, 2016, 5:23pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/3 "2016-03-09T17:23:37Z")

</div>

I have my logs saved in TXT format. Hence, I tried using input\_type: file. I read an article on that.  
But now I have used input\_type: log and corrected my log paths to -  
paths:  
- C:\LogFiles\*  
- C:\Log Files 1\*  
- C:\Log Files 2\*

This works fine. But it doesnt works when I add a shared server path

- \ServerName\Shared\ServiceLogs\*

Is there anything that I am missing here ?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 10, 2016, 11:37am UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/4 "2016-03-10T11:37:53Z")

</div>

Can you link to the article where it was stated that input\_type: file exist? It would be good to notifiy the author that this is incorrect. Otherwise other people will follow the same example.

What do you mean by a Shared server path? Shared drive? Is ServiceLogs the prefix of your files or a directory?

---

<div class="post-metadata">

**Author:** ![Sameer\_Panicker](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\
**Post date:** [March 10, 2016, 6:11pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/5 "2016-03-10T18:11:55Z")

</div>

Sorry, I don't have that link now. I found that during my initial analysis. Will try to search for it.

By shared path I meant, the path where logs on my servers are stored. I have shared the logs folder on all my servers with a group of people.  
Sorry for the typo above

- \ServerName\Shared\ServiceLogs\*

Cant I use a shared location in the config file ?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 11, 2016, 11:07am UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/6 "2016-03-11T11:07:19Z")

</div>

Path for remote drives should work as there is nothing really different about it from a filebeat perspective. But an important note here is that we don't recommend to do this. See [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-network-volumes.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-network-volumes.html)

Try to install filebeat as close to the source if possible.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/filebeat-not-picking-up-the-updated-file-asap/43821/7 "2017-07-05T21:54:42Z")

</div>


