# Filebeat registry data.json is empty

**URL:** <https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 10, 2020, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709 "2020-07-10T13:53:57Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sai\_Avinash\_Duddupud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_avinash_duddupud/32/48265_2.png) [@Sai\_Avinash\_Duddupud](https://discuss.elastic.co/u/Sai_Avinash_Duddupud)\
**Post date:** [July 10, 2020, 1:53pm UTC](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709/1 "2020-07-10T13:53:57Z")

</div>

I am trying to setup **filebeat** , but it **not harvesting logs** at all from the given log file path.

After lot of research, I came to know that **data.json in registry folder is empty** which is why filebeat is unable to read logs from log file.

Can someone please suggest how to fix this?

**Note** :- there is no error in filebeat logs saying permission denied to write into data.json

**filebeat.yml**

```
filebeat.inputs:
- type: log
  enabled: true
  paths:
    - /home/mahesh/Documents/refactor/nomi/unity/media/*.log

output.logstash:
  enabled: true
  hosts: ["localhost:5044"]
```

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [July 14, 2020, 7:18am UTC](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709/2 "2020-07-14T07:18:33Z")

</div>

Hi!

`data.json` file is used by Filebeat to store states of harvested files. If Filebeat is not harvesting from files then this `data.json` file will be empty. So what you watch is symptom and not the reason.

Could you please start filebeat in debug mode (`./filebeat -e -d "*"`) and share the logs with us?

C.

---

<div class="post-metadata">

**Author:** ![Sai\_Avinash\_Duddupud](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sai_avinash_duddupud/32/48265_2.png) [@Sai\_Avinash\_Duddupud](https://discuss.elastic.co/u/Sai_Avinash_Duddupud)\
**Post date:** [July 14, 2020, 7:36am UTC](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709/3 "2020-07-14T07:36:07Z")

</div>

@ChrsMark yes, you are correct... I have changed the filebeat yml to following config and it worked. althought still i coudnlt see the logs in filebeat but its being sent to logstash directly in real time 🙂

```
filebeat.inputs:
- type: log
  paths:
    - /your/path/goes/here/*.log
output.logstash:
  enabled: true
  hosts: ["localhost:5044"]
logging.level: info
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 7
  permissions: 0644
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 11, 2020, 9:36am UTC](https://discuss.elastic.co/t/filebeat-registry-data-json-is-empty/240709/4 "2020-08-11T09:36:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.