# Filebeat.prospectors not working

**URL:** <https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 20, 2018, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203 "2018-08-20T15:37:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![roi\_romano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/roi_romano/32/84708_2.png) [@roi\_romano](https://discuss.elastic.co/u/roi_romano)\
**Post date:** [August 20, 2018, 3:37pm UTC](https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203/1 "2018-08-20T15:37:32Z")

</div>

The filebeat service is up running, but it is not listening to the ngnix logs by the ngnix.yml. It works as desired if I manually add the input\_type property with the path to the ngnix logs in the main filebeat.yml.  
this is th filebeat.yml:

```auto
shutdown_timeout: '0'
name: ip-172-30-0-139.cscloud.com
tags: []
fields: {}
fields_under_root: false
filebeat:
  registry_file: "/var/lib/filebeat/registry"
  config.prospectors:
    enabled: true
    path: "/etc/filebeat/conf.d/*.yml"
  shutdown_timeout: '0'
  modules: []
output:
  logstash:
    hosts:
    - 172.30.0.170:5044
    loadbalance: true
shipper: {}
logging: {}
runoptions: {}
processors: []
setup: {}
xpack: :undef
------------------------------------------

this is the ngnix.yml:

- type: log
  paths:
    - /var/log/nginx/*.log
  encoding: plain
  fields_under_root: false
  document_type: log
  scan_frequency: 10s
  harvester_buffer_size: 16384
  max_bytes: 10485760

  tail_files: false

  # Experimental: If symlinks is enabled, symlinks are opened and harvested. The harvester is openening the
  # original for harvesting but will report the symlink name as source.
  #symlinks: false

  backoff: 1s
  max_backoff: 10s
  backoff_factor: 2

  # Experimental: Max number of harvesters that are started in parallel.
  # Default is 0 which means unlimited
  #harvester_limit: 0

  ### Harvester closing options

  # Close inactive closes the file handler after the predefined period.
  # The period starts when the last line of the file was, not the file ModTime.
  # Time strings like 2h (2 hours), 5m (5 minutes) can be used.
  close_inactive: 5m

  # Close renamed closes a file handler when the file is renamed or rotated.
  # Note: Potential data loss. Make sure to read and understand the docs for this option.
  close_renamed: false

  # When enabling this option, a file handler is closed immediately in case a file can't be found
  # any more. In case the file shows up again later, harvesting will continue at the last known position
  # after scan_frequency.
  close_removed: true

  # Closes the file handler as soon as the harvesters reaches the end of the file.
  # By default this option is disabled.
  # Note: Potential data loss. Make sure to read and understand the docs for this option.
  close_eof: false

  ### State options

  # Files for the modification data is older then clean_inactive the state from the registry is removed
  # By default this is disabled.
  clean_inactive: 0

  # Removes the state for file which cannot be found on disk anymore immediately
  clean_removed: true

  # Close timeout closes the harvester after the predefined time.
  # This is indepen
```

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [August 21, 2018, 6:00pm UTC](https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203/2 "2018-08-21T18:00:19Z")

</div>

@roi_romano Where the nginx is located? it is in the `/etc/filebeat/conf.d/` directory?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 18, 2018, 6:00pm UTC](https://discuss.elastic.co/t/filebeat-prospectors-not-working/145203/3 "2018-09-18T18:00:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.