# Filebeat only reporting on last prospector **URL:** \ **Category:** Beats\ **Created:** [February 9, 2016, 3:52am UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237 "2016-02-09T03:52:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![bluethundr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bluethundr/32/409_2.png) [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Post date:** [February 9, 2016, 3:52am UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237/1 "2016-02-09T03:52:34Z")
Hey guys, I'm trying to recreate my lumberjack configuration in filebeats. My lumberjack configuration had been working great for me for a number of years! But I like the convenience of notating things in yaml way better than using json. Also I like keeping up with advances and developments from Elastic. I've seen that in my attempt to duplicate the lumberjack config in filebeats, the config only seems to pick up the last entry which is for the php file. In my filebeat logs I see these messages repeated over and over again: ```auto [root@web1:~] #tail -f /var/log/filebeat/filebeat.log 2016-02-08T22:44:35-05:00 DBG Check file for harvesting: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:35-05:00 DBG Update existing file for harvesting: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:35-05:00 DBG Not harvesting, file didn't change: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:37-05:00 DBG Flushing spooler because of timemout. Events flushed: 0 2016-02-08T22:44:45-05:00 DBG Flushing spooler because of timemout. Events flushed: 0 2016-02-08T22:44:45-05:00 DBG Start next scan 2016-02-08T22:44:45-05:00 DBG scan path /var/log/httpd/jf_php_error.log 2016-02-08T22:44:45-05:00 DBG Check file for harvesting: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:45-05:00 DBG Update existing file for harvesting: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:45-05:00 DBG Not harvesting, file didn't change: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:52-05:00 DBG Flushing spooler because of timemout. Events flushed: 0 2016-02-08T22:44:55-05:00 DBG Start next scan 2016-02-08T22:44:55-05:00 DBG scan path /var/log/httpd/jf_php_error.log 2016-02-08T22:44:55-05:00 DBG Check file for harvesting: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:55-05:00 DBG Update existing file for harvesting: /var/log/httpd/jf_php_error.log 2016-02-08T22:44:55-05:00 DBG Not harvesting, file didn't change: /var/log/httpd/jf_php_error.log ``` It's only picking up the last prospector which is for the php log file. Here's my filebeat config: ```auto filebeat: prospectors: - paths: - /var/log/httpd/jf_ref.example.com_access_log document_type: apache input_type: log fields: service: apache type: apache_ref_access paths: - /var/log/httpd/jf_ref.example.com_error_log document_type: apache input_type: log fields: service: apache type: apache_ref_error paths: - /var/log/httpd/jf_beta.example.com_access_log document_type: apache input_type: log fields: service: apache type: apache_beta_access paths: - /var/log/httpd/jf_beta.example.com_error_log document_type: apache fields: service: apache type: apache_beta_error paths: - /var/log/httpd/jf_dev.example.com_access_log document_type: apache input_type: log fields: service: apache type: apache_dev_access paths: - /var/log/httpd/jf_dev.example.com_error_log document_type: apache input_type: log fields: service: apache type: apache_dev_error paths: - /var/log/httpd/jf_php_error.log document_type: php input_type: log fields: service: php type: php #paths: # - /var/log/*.log # - /var/log/*/*.log #input_type: log registry_file: /var/lib/filebeat/registry output: logstash: hosts: - logs.example.com:5000 index: filebeat #tls: # certificate_authorities: # - /etc/pki/CA/certs/ca.crt shipper: name: filebeat tags: ["example-dev", "web-tier"] ignore_outgoing: true refresh_topology_freq: 10 logy_expire: 15 logging: level: debug # enable file rotation with default configuration to_files: true # do not log to syslog to_syslog: false files: path: /var/log/filebeat name: filebeat.log keepfiles: 7 ``` What am I doing wrong so that filebeat is only picking up the php log prospector? Thanks ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [February 9, 2016, 4:15am UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237/2 "2016-02-09T04:15:30Z")
In YAML terms the `prospectors` is a list of dictionaries. You only have one element in your prospectors list (the single `-` directly under `prospectors`). So add some dashes to create separate dictionaries for each prospector you want to define. ```auto filebeat: prospectors: - paths: - /var/log/httpd/jf_ref.example.com_access_log document_type: apache input_type: log fields: service: apache type: apache_ref_access - paths: - /var/log/httpd/jf_ref.example.com_error_log document_type: apache input_type: log fields: service: apache type: apache_ref_error # You should also be able to put the dash on the same line as paths. - paths: - /var/log/httpd/jf_beta.example.com_access_log document_type: apache ... ``` ---
**Author:** ![bluethundr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bluethundr/32/409_2.png) [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Post date:** [February 9, 2016, 4:46am UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237/3 "2016-02-09T04:46:51Z")
> [@andrewkroh](#): > > In YAML terms the prospectors is a list of dictionaries. You only have one element in your prospectors list (the single - directly under prospectors). So add some dashes to create separate dictionaries for each prospector you want to define. Thanks for the advice! That did it. Filebeat works fine now. 😄 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:55pm UTC](https://discuss.elastic.co/t/filebeat-only-reporting-on-last-prospector/41237/4 "2017-07-05T21:55:55Z")