# Filebeat read only one folder

**URL:** <https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748>\
**Category:** Beats\
**Created:** [February 27, 2018, 10:50pm UTC](https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748 "2018-02-27T22:50:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Romain\_Pelissier](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/romain_pelissier/32/19806_2.png) [@Romain\_Pelissier](https://discuss.elastic.co/u/Romain_Pelissier)\
**Post date:** [February 27, 2018, 10:50pm UTC](https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748/1 "2018-02-27T22:50:58Z")

</div>

Hi,  
I got filebeat running on a pfsense box (using pkgadd beat package):

`filebeat version 5.4.3 (amd64), libbeat 5.4.3`

I have configured my filebeat agent to grab logs from a path where logs from 2 snort interfaces are located:

```
ls -alrt /var/log/snort/
total 39
drwxr-xr-x 4 root wheel 5 Feb 7 22:38 .
drwxr-xr-x 8 root wheel 32 Feb 9 18:55 ..
-rw-r--r-- 1 root wheel 67093 Feb 27 12:04 snort_rules_update.log
drwxr-xr-x 3 root wheel 8 Feb 27 12:06 snort_em1.536159
drwxr-xr-x 3 root wheel 6 Feb 27 12:31 snort_pppoe064290

```

in each snort folders, an alert file is present which contains the alerts:

```
[2.4.2-RELEASE][admin@pf]/root: tail -1 /var/log/snort/snort_em1.536159/alert
02/27/18-17:46:12.794270 ,119,33,1,"(http_inspect) UNESCAPED SPACE IN HTTP URI",TCP,192.168.5.20,21103,192.168.4.2,3128,0,Unknown Traffic,3

    [2.4.2-RELEASE][admin@pf]/root: tail -1 /var/log/snort/snort_pppoe064290/alert
    02/27/18-17:20:05.848441 ,140,26,1,"(spp_sip) Method is unknown",UDP,51.15.208.144,5102,69.157.137.159,5060,48979,Potentially Bad Traffic,2

```

Here is my filebeat.yml config:

```
#------------------------- File prospectors --------------------------------
filebeat.prospectors:
- input_type: log
  paths:
    - /var/log/snort/*/alert
  tags: ["snort_ips"]
  fields_under_root: true
  fields:
    type: "snort"
  document_type: snort

#----------------------------- Logstash output --------------------------------
output.logstash:
  hosts: ["192.168.4.10:5000"]

#---------------------------- filebeat logging -------------------------------

logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat.log
  keepfiles: 7

```

For an unknown reason only the /var/log/snort/snort\_em1.536159/alert file seems to be scan by the filebeat agent. On my remote logstash destination and in kibana I can't see any events from the pppoe interface and the filebeat logs do not see any mention of an event seen in the snort's pppoe interface...

Any idea?  
Thanks!

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [February 28, 2018, 8:15am UTC](https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748/2 "2018-02-28T08:15:48Z")

</div>

Can you enable debug looging in filebeat and share the output here. This should give us more details on what is happening.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2018, 10:15am UTC](https://discuss.elastic.co/t/filebeat-read-only-one-folder/121748/3 "2018-03-28T10:15:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.