# Filebeat only sends the first log input

**URL:** <https://discuss.elastic.co/t/filebeat-only-sends-the-first-log-input/339549>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 28, 2023, 1:09pm UTC](https://discuss.elastic.co/t/filebeat-only-sends-the-first-log-input/339549 "2023-07-28T13:09:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dcz01](https://avatars.discourse-cdn.com/v4/letter/d/9f8e36/32.png) [@dcz01](https://discuss.elastic.co/u/dcz01)\
**Post date:** [July 28, 2023, 1:09pm UTC](https://discuss.elastic.co/t/filebeat-only-sends-the-first-log-input/339549/1 "2023-07-28T13:09:37Z")

</div>

Hello,

I got an filebeat.yml with an filebeat 7.8.0 instance on an server which should send some logs to a central logstash but it only sends the first log input and the others seemd to be ignored or anything else.  
Can anyone explain that?

Here is the filebeat.yml:

```auto
#================================ General =====================================
logging.to_syslog: false

#============================= Filebeat custom logs ===============================

filebeat.inputs:
- type: log
  tags: ["opengate_syslog"]
  paths:
    - "/mnt/og_logs/*/log/syslog.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["opengate_traffic_incoming"]
  paths:
    - "/mnt/og_logs/*/log/traffic_incoming_*.log"
  exclude_files: ['\.gz$','\.bz2$']

- type: log
  tags: ["opengate_traffic_outgoing"]
  paths:
    - "/mnt/og_logs/*/log/traffic_outgoing_*.log"
  exclude_files: ['\.gz$','\.bz2$']

- type: log
  tags: ["backstage_syslog"]
  paths:
    - "/mnt/san/fast/st*/instances/*/log/syslog_*.log"
    - "/mnt/san/fast/webcache/instances/*/log/syslog_*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["render_processhandler"]
  paths:
    - "/mnt/san/fast/st*/instances/*/processing/processhandler/log/processhandler_*render*.log"
    - "/mnt/san/fast/st*/instances/*/processing/processhandler/log/processhandler_*rdr*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["ftp_in_mediamonitor"]
  paths:
    - "/mnt/san/fast/*/instances/*/processing/mediamonitor/log/mediamonitor_*ftp-in*.log"
  exclude_files: ['\.gz$', '\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2}'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["ftp_out_processhandler"]
  paths:
    - "/mnt/san/fast/st*/instances/*/processing/processhandler/log/processhandler_*ftp-out*.log*"
  exclude_files: ['\.gz$', '\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}\"'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["api_accesslog"]
  paths:
    - "/mnt/san/fast/st*/instances/*/log/api_access_*.log"
    - "/mnt/san/fast/webcache/instances/*/log/api_access_*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}\"'
  multiline.negate: true
  multiline.match: after

- type: log
  tags: ["api_errorlog"]
  paths:
    - "/mnt/san/fast/st*/instances/*/log/api_error_*.log"
    - "/mnt/san/fast/webcache/instances/*/log/api_error_*.log"
  exclude_files: ['\.gz$','\.bz2$']
  multiline.pattern: '^\"[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}.[0-9]{3}\"'
  multiline.negate: true
  multiline.match: after

#==================== Elasticsearch template setting ==========================

setup.template.settings:
  index.number_of_shards: 1

#================================ Outputs =====================================

#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ['pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5044', 'pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5045', 'pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5046', 'pr-fe-log-elk-01-access.dc.muc.picturemaxx.net:5047']
  loadbalance: true

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2023, 3:10pm UTC](https://discuss.elastic.co/t/filebeat-only-sends-the-first-log-input/339549/2 "2023-08-25T15:10:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.