# Filebeat not sending specific Log Files

**URL:** <https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 4, 2019, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776 "2019-03-04T18:53:44Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shiva\_jawanjal](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@shiva\_jawanjal](https://discuss.elastic.co/u/shiva_jawanjal)\
**Post date:** [March 4, 2019, 6:53pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776/1 "2019-03-04T18:53:45Z")

</div>

I have configured filebeat 6.6 on a Windows instance. Weird thing is, it is sending logs for IIS but not for file I have specified even though the filebeat can detect it.

Filebeat.yml --\>

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
 - C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\LowError.txt
- type: log
  enabled: true
  paths:
 - C:\inetpub\logs\LogFiles\*\*
 - C:\Hosting\stagingb2c\PaymentGatewayLogs\*\*
  recursive_glob: enabled 
- type: log
  enabled: true
  paths:
 - C:\Hosting\stagingb2c\ErrorLogs\*
  

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template.settings:
  index.number_of_shards: 3

output.logstash:
  hosts: ["13.234.83.186:5044"]

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~

logging:
  to_files: true
  files:
path: C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\filebeat-6.6.1-windows-x86_64\LOG
  level: info

```

I can see logs from `C:\inetpub\logs\LogFiles` folder but not from `C:\Hosting\stagingb2c\PaymentGatewayLogs`.

I can not see any errors or warnings in filebeat.log when I started it with 🙂

`PS C:\ELK-Logger\filebeat-6.6.1-windows-x86_64\filebeat-6.6.1-windows-x86_64> .\filebeat.exe -e -d "*"`

```
    |2019-03-04T21:15:51.602+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId_12f1050220190810\CredimaxPayment_TransactionDetails_OrderId_12f1050220190810|
|---|---|---|---|
|2019-03-04T21:15:51.761+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId_Sw2m\CredimaxPayment_PROCESS_ACS_RESULT_Response_20190213124610_OrderId_Sw2m.txt|
|2019-03-04T21:15:51.920+0300|INFO|log/harvester.go:255|Harvester started for file: C:\Hosting\stagingb2c\PaymentGatewayLogs\CredimaxPaymentGateway_OrderId __SoLx\CredimaxPayment_PAY_Request_20190205085701_OrderId__ SoLx.txt|

```

I am not able to see these logs in logstash though I can surely see other files coming in Logstash.

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [March 6, 2019, 4:07pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776/2 "2019-03-06T16:07:57Z")

</div>

Is there any error on the Logstash and could you share that configuration?

---

<div class="post-metadata">

**Author:** ![shiva\_jawanjal](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@shiva\_jawanjal](https://discuss.elastic.co/u/shiva_jawanjal)\
**Post date:** [March 7, 2019, 5:38am UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776/3 "2019-03-07T05:38:42Z")

</div>

My logstash.yml file has a basic configuration

```
root@ip-172-31-27-22:/etc/logstash# cat logstash.yml | grep -v "#"
path.data: /var/lib/logstash
path.logs: /var/log/logstash
```

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [March 7, 2019, 1:48pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776/4 "2019-03-07T13:48:59Z")

</div>

Sorry I was not clear enough in my request, I was talking about y our Logstash pipeline configuration.

---

<div class="post-metadata">

**Author:** ![shiva\_jawanjal](https://avatars.discourse-cdn.com/v4/letter/s/e0b2c6/32.png) [@shiva\_jawanjal](https://discuss.elastic.co/u/shiva_jawanjal)\
**Post date:** [March 7, 2019, 6:28pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776/5 "2019-03-07T18:28:38Z")

</div>

I don't have much configured there either.

```
root@ip-172-31-27-22:/etc/logstash# cat pipelines.yml | grep -v "#"

- pipeline.id: main
  path.config: "/etc/logstash/conf.d/*.conf"

```

Also,

```
root@ip-172-31-27-22:/etc/logstash# cat conf.d/02-beats-input.conf 

input {

beats {

client_inactivity_timeout =&gt; 1200

port =&gt; 5044

}

}

root@ip-172-31-27-22:/etc/logstash# cat conf.d/30-elasticsearch-output.conf 

output {

elasticsearch {

hosts =&gt; ["localhost:9200"]

manage_template =&gt; false

index =&gt; "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

}

}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2019, 6:28pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-specific-log-files/170776/6 "2019-04-04T18:28:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.