# Filebeat: Reading the log files remotely

**URL:** <https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 22, 2017, 11:40am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577 "2017-03-22T11:40:35Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![mruthyu](https://avatars.discourse-cdn.com/v4/letter/m/bb73d2/32.png) [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Post date:** [March 22, 2017, 11:40am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/1 "2017-03-22T11:40:35Z")

</div>

Whether filebeat can be used to read the log files (Webserver, Application,.etc) remotely, instead of installing it on the server where the logs reside?

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [March 22, 2017, 12:36pm UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/2 "2017-03-22T12:36:04Z")

</div>

On windows you can set prospector to a share

```auto
paths:
  - \\someshare\some_folder\test.log

```

Or better you mount the share to a drive for example z: and then just

```auto
- z:\some_folder\test.log

```

This should also work on linux, @ruflin @andrewkroh??

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 22, 2017, 10:59pm UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/3 "2017-03-22T22:59:49Z")

</div>

We don't recommend reading logs from a network share. [https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes](https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes)

---

<div class="post-metadata">

**Author:** ![netaibiswas](https://avatars.discourse-cdn.com/v4/letter/n/5f9b8f/32.png) [@netaibiswas](https://discuss.elastic.co/u/netaibiswas)\
**Post date:** [March 24, 2017, 1:33am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/4 "2017-03-24T01:33:49Z")

</div>

Hello, I have tried the same for linux machine, it didnt work. Can you please help me out on this.

Here are my detailed configuration:

- input\_type: log

Please let me know what I am missing here.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 24, 2017, 6:14am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/5 "2017-03-24T06:14:51Z")

</div>

> I have tried the same for linux machine, it didnt work.

Correct, because UNC paths only work on Windows. Install Filebeat on all machines where you want to collect logs.

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [March 24, 2017, 7:03am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/6 "2017-03-24T07:03:07Z")

</div>

> Correct, because UNC paths only work on Windows.

Of course. I meant with linux something like nfs. I thought this was clear.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [March 24, 2017, 7:04am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/7 "2017-03-24T07:04:46Z")

</div>

> Of course. I meant with linux something like nfs. I thought this was clear.

It was. I was just responding to @netaibiswas's question about use of UNC paths on Linux.

---

<div class="post-metadata">

**Author:** ![maddin2016](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maddin2016/32/16599_2.png) [@maddin2016](https://discuss.elastic.co/u/maddin2016)\
**Post date:** [March 24, 2017, 7:06am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/8 "2017-03-24T07:06:36Z")

</div>

@magnusbaeck 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2017, 7:07am UTC](https://discuss.elastic.co/t/filebeat-reading-the-log-files-remotely/79577/9 "2017-04-21T07:07:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.