# Filebeat reading file even after not mentioning it in filebeat.yml **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [July 21, 2017, 10:18am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098 "2017-07-21T10:18:14Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [July 21, 2017, 10:18am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/1 "2017-07-21T10:18:14Z")
Hello, I have a file which is not mentioned in the filebeat.yml but i can still see that opened by filebeat in lsof -c filebeat output. anyone any idea about what is happening here?? Thanks, Nitin ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [July 21, 2017, 10:33am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/2 "2017-07-21T10:33:37Z")
Could you please give more details? I would like to see the path for the file and filebeat settings ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [July 21, 2017, 10:45am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/3 "2017-07-21T10:45:07Z")
``` filebeat.prospectors: - input_type: log paths: - /var/log/secure - /var/log/messages document_type: sys-syslog - input_type: log paths: - /var/log/cron document_type: sys-cron - input_type: log paths: - /var/log/yum.log document_type: sys-yum output.logstash: enabled: true hosts: ["10.204.140.17:5044","10.204.141.17:5044","10.204.140.18:5044","10.204.141.18:5044"] worker: 1 loadbalance: true logging.to_files: true logging.files: ``` ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [July 21, 2017, 10:50am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/4 "2017-07-21T10:50:02Z")
I am pushing filebeat prospectors via ansible but they are not reflected in filebeat.yml . Even though in lsof output i can see the file is opened by filebeat ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [July 21, 2017, 10:54am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/5 "2017-07-21T10:54:08Z")
What's the open file? ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [July 21, 2017, 10:56am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/6 "2017-07-21T10:56:15Z")
sorry i didn't get that.. I am using this command "lsof -c filebeat " to see if file is read by filebeat. ---
**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\ **Post date:** [July 21, 2017, 10:58am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/7 "2017-07-21T10:58:36Z")
Got it, perhaps you can share the output of lsof? ---
**Author:** ![NITIN-BHAISARE](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Post date:** [July 21, 2017, 11:06am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/8 "2017-07-21T11:06:24Z")
![](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b20eee299539a986e8f72467715b5b3c7ca4d6c.png) nohup.out is the file ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [July 21, 2017, 11:36am UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/9 "2017-07-21T11:36:16Z")
I suspect that what happens here is that ansible or something else runs the init script command via `nohup` (the `nohup.out` is specific for that command). The file descriptor gets passed through a couple of forks and execs and eventually is inherited by filebeat itself. What ansible module do you use for starting filebeat? Generally `nohup` shouldn't be needed. ---
**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\ **Post date:** [July 21, 2017, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/10 "2017-07-21T14:23:19Z")
In any case, it's not that Filebeat is reading that file, just that it has a reference to it. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 18, 2017, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-reading-file-even-after-not-mentioning-it-in-filebeat-yml/94098/11 "2017-08-18T14:24:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.