# Filebeat not working on a particular path

**URL:** <https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 21, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845 "2021-04-21T13:17:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ashu\_29516](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@ashu\_29516](https://discuss.elastic.co/u/ashu_29516)\
**Post date:** [April 21, 2021, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845/1 "2021-04-21T13:17:02Z")

</div>

Hi Everyone,

I'm new to Elasticsearch and have been facing an issue with filebeats where I've been observing that logs from certain paths do not seem to get picked when the file in that path is updated. Running filebeat in debugger mode also doesn't show up anything relevant to that path.

However, upon deleting the registry file, filebeat detects the file. This I can say as I see a log message that the harvester has started on the file.

A snippet of how the YAML configuration for the concerned path appear is below.

```auto
    - type: log
      enabled: true
      paths:
         - /data/hddata*/hadoop-yarn/container/application_*/container*/*
      fields:
         log_type: log
      ignore_older: 2h
      scan_frequency: 1s
      close_inactive: 1m
      close_timeout: 5m
      fields_under_root: true

```

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 22, 2021, 1:02am UTC](https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845/2 "2021-04-22T01:02:05Z")

</div>

I would check the settings for how u have the `close_*` options or the ignore\_older. [Log input | Filebeat Reference [7.12] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#filebeat-input-log-ignore-older).

---

<div class="post-metadata">

**Author:** ![ashu\_29516](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@ashu\_29516](https://discuss.elastic.co/u/ashu_29516)\
**Post date:** [April 22, 2021, 7:13am UTC](https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845/3 "2021-04-22T07:13:35Z")

</div>

Hi Alex,

Thanks for sharing this.

I'm not sure if `ignore_older` is the issue as I'm manually changing the file in the concerned path while monitoring real time filebeat logs. Still I don't see the harvester detecting the changes.

Not sure, but is it possible that the state for the file is causing an issue here and if so using `clean_inactive` can solve it? However, would using `clean_inactive` also mean that this would cause the entire file to be ingested again including the lines which were already ingested before?

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [April 22, 2021, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845/4 "2021-04-22T12:21:38Z")

</div>

that i don't know, i would have to refer you to the docs on that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 20, 2021, 2:21pm UTC](https://discuss.elastic.co/t/filebeat-not-working-on-a-particular-path/270845/5 "2021-05-20T14:21:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.