# Filebeat not using configured path on Windows **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 24, 2017, 5:59pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688 "2017-01-24T17:59:03Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![kpaulsenegain](https://avatars.discourse-cdn.com/v4/letter/k/d2c977/32.png) [@kpaulsenegain](https://discuss.elastic.co/u/kpaulsenegain)\ **Post date:** [January 24, 2017, 5:59pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688/1 "2017-01-24T17:59:03Z")
For this configuration: ```auto ###################### Filebeat Configuration Example ######################### # This file is an example configuration file highlighting only the most common # options. The filebeat.full.yml file from the same directory contains all the # supported options with more comments. You can use it as a reference. # # You can find the full configuration reference here: # https://www.elastic.co/guide/en/beats/filebeat/index.html #=========================== Filebeat prospectors ============================= filebeat.prospectors: # Each - is a prospector. Most options can be set at the prospector level, so # you can use different prospectors for various configurations. # Below are the prospector specific configurations. - input_type: log # Paths that should be crawled and fetched. Glob based paths. paths: #- /var/log/*.log #- c:\programdata\elasticsearch\logs\* - d:\workspace\Indexers\tempIIS\* ``` When I start filebeat with this command `filebeat -c filebeat.yml -v -d "*"` this is what I get: `2017-01-24T09:51:45-08:00 INFO Metrics logging every 30s 2017-01-24T09:51:45-08:00 INFO Home path: [C:\Program Files\Filebeat] Config path: [C:\Program Files\Filebeat] Data path: [C:\Program Files\Filebeat\data] Logs path: [C:\Program Files\Filebeat\logs] 2017-01-24T09:51:45-08:00 INFO Setup Beat: filebeat; Version: 5.1.2 2017-01-24T09:51:45-08:00 DBG Processors: 2017-01-24T09:51:45-08:00 DBG Initializing output plugins 2017-01-24T09:51:45-08:00 INFO Loading template enabled. Reading template file: C:\Program Files\Filebeat\filebeat.template.json 2017-01-24T09:51:45-08:00 INFO Loading template enabled for Elasticsearch 2.x. Reading template file: C:\Program Files\Filebeat\filebeat.template-es2x.json 2017-01-24T09:51:45-08:00 INFO Elasticsearch url: http://localhost:9200 2017-01-24T09:51:45-08:00 INFO Activated elasticsearch as output plugin. 2017-01-24T09:51:45-08:00 DBG Create output worker 2017-01-24T09:51:45-08:00 DBG No output is defined to store the topology. The server fields might not be filled. 2017-01-24T09:51:45-08:00 INFO Publisher name: SAVCORP360 2017-01-24T09:51:45-08:00 INFO Flush Interval set to: 1s 2017-01-24T09:51:45-08:00 INFO Max Bulk Size set to: 50 2017-01-24T09:51:45-08:00 DBG create bulk processing worker (interval=1s, bulk size=50) 2017-01-24T09:51:45-08:00 INFO filebeat start running. 2017-01-24T09:51:45-08:00 DBG Windows is interactive: true 2017-01-24T09:51:45-08:00 INFO Registry file set to: C:\Program Files\Filebeat\data\registry 2017-01-24T09:51:45-08:00 INFO Loading registrar data from C:\Program Files\Filebeat\data\registry 2017-01-24T09:51:45-08:00 INFO States Loaded from registrar: 0 2017-01-24T09:51:45-08:00 INFO Loading Prospectors: 1 2017-01-24T09:51:45-08:00 INFO Starting Registrar 2017-01-24T09:51:45-08:00 INFO Start sending events to output 2017-01-24T09:51:45-08:00 INFO Starting spooler: spool_size: 2048; idle_timeout: 5s 2017-01-24T09:51:45-08:00 DBG exclude_files: [] 2017-01-24T09:51:45-08:00 INFO Prospector with previous states loaded: 0 2017-01-24T09:51:45-08:00 DBG File Configs: [/var/log/*.log] 2017-01-24T09:51:45-08:00 INFO Loading Prospectors completed. Number of prospectors: 1 2017-01-24T09:51:45-08:00 INFO All prospectors are initialised and running with 0 states to persist 2017-01-24T09:51:45-08:00 DBG Starting prospector 0 2017-01-24T09:51:45-08:00 INFO Starting prospector of type: log 2017-01-24T09:51:45-08:00 DBG Start next scan` - Why is the `File Configs: [var/log/*.log]`? - How to I identify that once the system is started the prospector is looking at the correct configured path? This is on a Window server. ---
**Author:** ![kpaulsenegain](https://avatars.discourse-cdn.com/v4/letter/k/d2c977/32.png) [@kpaulsenegain](https://discuss.elastic.co/u/kpaulsenegain)\ **Post date:** [January 24, 2017, 6:41pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688/2 "2017-01-24T18:41:38Z")
When I moved the directory from not being in Program Files and put it in another directory that seems to have corrected it ---
**Author:** ![kpaulsenegain](https://avatars.discourse-cdn.com/v4/letter/k/d2c977/32.png) [@kpaulsenegain](https://discuss.elastic.co/u/kpaulsenegain)\ **Post date:** [January 24, 2017, 6:44pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688/3 "2017-01-24T18:44:18Z")
So I'm confused on how to get this configured based on the documentation when I configure as a service it puts registry stuff in a Hidden directory ProgramsData and when I run it command line it puts it in the home directory under data and I was not able to get it working running as a service but will play around with that later ---
**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\ **Post date:** [January 25, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688/4 "2017-01-25T12:40:46Z")
You can configure the location of the registry file with `filebeat.registry_file:`. It depends on what the `path.*` variables are set to. Make sure you point to the correct config file when running filebeat. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 22, 2017, 12:40pm UTC](https://discuss.elastic.co/t/filebeat-not-using-configured-path-on-windows/72688/5 "2017-02-22T12:40:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.