# Filebeat not processing all configured files if we run as service

**URL:** <https://discuss.elastic.co/t/filebeat-not-processing-all-configured-files-if-we-run-as-service/173575>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 23, 2019, 3:11am UTC](https://discuss.elastic.co/t/filebeat-not-processing-all-configured-files-if-we-run-as-service/173575 "2019-03-23T03:11:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![subramani.k1990](https://avatars.discourse-cdn.com/v4/letter/s/b9e5f3/32.png) [@subramani.k1990](https://discuss.elastic.co/u/subramani.k1990)\
**Post date:** [March 23, 2019, 3:11am UTC](https://discuss.elastic.co/t/filebeat-not-processing-all-configured-files-if-we-run-as-service/173575/1 "2019-03-23T03:11:31Z")

</div>

Hi all,

I have configured 4 input files in filebeat.yml.

If i start the filebeat via Command prompt then all the 4 files were processed and logs sent to Logstash.

But If i start file beat as a Service then only two files getting processed.

filebeat.inputs:

- type: log  
enabled: true  
paths:

- type: log  
enabled: true  
paths:

2019-03-23T13:42:06.599+1100 INFO log/input.go:138 Configured paths: [\networkA\logs\typeAserver\server1.log \networkA\logs\typeAserver\server2.log]  
2019-03-23T13:42:06.599+1100 INFO input/input.go:114 Starting input of type: log; ID: 18182795938752183068  
2019-03-23T13:42:06.847+1100 INFO log/input.go:138 Configured paths: [\networkB\logs\typeBserver\server1.log \networkB\logs\typeBserver\server2.log]  
2019-03-23T13:42:06.847+1100 INFO input/input.go:114 Starting input of type: log; ID: 11228700993579301930  
2019-03-23T13:42:07.025+1100 INFO log/harvester.go:251 Harvester started for file: \networkB\logs\typeBserver\server1.log  
2019-03-23T13:42:07.092+1100 INFO log/harvester.go:251 Harvester started for file: \networkB\logs\typeBserver\server2.log  
2019-03-23T13:42:08.602+1100 INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 2  
2019-03-23T13:42:08.602+1100 INFO cfgfile/reload.go:140 Config reloader started  
2019-03-23T13:42:08.603+1100 INFO cfgfile/reload.go:195 Loading of config files completed.

But if run thorough command line then i am not getting any issues. all 4 files are processed.

Anyone faced the above issue?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [March 25, 2019, 10:11am UTC](https://discuss.elastic.co/t/filebeat-not-processing-all-configured-files-if-we-run-as-service/173575/2 "2019-03-25T10:11:37Z")

</div>

Could you please format the configuration using `</>`?  
Is this possible that Filebeat previously read those two files when you ran it from the command line? Do they share registry files?  
I think when you start Filebeat as a service, no new line showed up in those two "skipped" since the command line instace encountered it.

---

<div class="post-metadata">

**Author:** ![subramani.k1990](https://avatars.discourse-cdn.com/v4/letter/s/b9e5f3/32.png) [@subramani.k1990](https://discuss.elastic.co/u/subramani.k1990)\
**Post date:** [March 26, 2019, 7:04am UTC](https://discuss.elastic.co/t/filebeat-not-processing-all-configured-files-if-we-run-as-service/173575/3 "2019-03-26T07:04:48Z")

</div>

Initially, registry files were different for both.

Then I update the config to use the same registry by add the below lines in filebeat.yml file.

path.data: C:\ProgramData\filebeat

But, Both the times NETWORKALogs were not processed.

Yes. Registry files shared by both.

All the files are continuously updated with new lines by JBOSS server every 5 seconds.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 23, 2019, 7:09am UTC](https://discuss.elastic.co/t/filebeat-not-processing-all-configured-files-if-we-run-as-service/173575/4 "2019-04-23T07:09:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
