# Filebeat prospector enable / disabled being ignored

**URL:** <https://discuss.elastic.co/t/filebeat-prospector-enable-disabled-being-ignored/147456>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 5, 2018, 6:01pm UTC](https://discuss.elastic.co/t/filebeat-prospector-enable-disabled-being-ignored/147456 "2018-09-05T18:01:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![TechSavvy](https://avatars.discourse-cdn.com/v4/letter/t/e47774/32.png) [@TechSavvy](https://discuss.elastic.co/u/TechSavvy)\
**Post date:** [September 5, 2018, 6:01pm UTC](https://discuss.elastic.co/t/filebeat-prospector-enable-disabled-being-ignored/147456/1 "2018-09-05T18:01:31Z")

</div>

Hello.

We were using the ELK stack with Filebeat prospector input configured, running everything on 6.3.1. Everything was working as expected. A week ago, upgraded ES, LS, and Kibana to 6.4.0 but left Filebeat on 6.3.1 (by accident, actually), and everything was still running fine afterward. Yesterday, I upgraded Filebeat to 6.4.0, moved over my config file and all my prospector files. Did what I needed to do to upgrade run as service (on windows 10 machine), restarted everything, and now it just ingests absolutely everything regardless of whether you have that particular prospector enabled or not.

Example  
From filebeat.yml file:  
filebeat.config.inputs:  
enabled: true  
path: C:\Elastic\Filebeat\6.4.0\config\*\*\*.yml  
reload.enabled: true  
reload.period: 10s

beginning of prospector file:

> 

- type: log  
enabled: false  
paths:
  - C:\Elastic....  
ignore \_older: 1209600  
.................................more stuff..................  
\<  
So the line above in the prospector file of "enabled: false" - it seems to just be ignoring that line altogether as of 6.4.0.

Thoughts?

---

<div class="post-metadata">

**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\
**Post date:** [September 6, 2018, 7:19am UTC](https://discuss.elastic.co/t/filebeat-prospector-enable-disabled-being-ignored/147456/2 "2018-09-06T07:19:56Z")

</div>

Could you please format your configuration using `</>`? Please attach the debug logs of Filebeat (`filebeat -e -d "*"`).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 4, 2018, 7:19am UTC](https://discuss.elastic.co/t/filebeat-prospector-enable-disabled-being-ignored/147456/3 "2018-10-04T07:19:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.