# Filebeat running as root, but not ingesting all logs
**URL:** https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583
**Category:** Beats
**Tags:** filebeat
**Created:** [November 6, 2020, 9:24pm UTC](https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583 "2020-11-06T21:24:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@droidus](https://discuss.elastic.co/u/droidus)
#### Post date: [November 6, 2020, 9:24pm UTC](https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583/1 "2020-11-06T21:24:36Z")
I am running Ubuntu, and I noticed in Kibana, it is only monitoring two files: kern.log and auth.log. Here are what the file permissions look like: -rw-r----- 1 syslog adm. Doing a ps aux, I get this:
root 17888 0.1 0.2 1758840 90964 ? SLsl Nov05 2:06 /usr/share/filebeat/bin/filebeat --environment systemd -c /etc/filebeat/filebeat.yml --path.home /usr/share/filebeat --path.config /etc/filebeat --path.data /var/lib/filebeat --path.logs /var/log/filebeat
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [November 9, 2020, 8:23am UTC](https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583/2 "2020-11-09T08:23:56Z")
Not sure if I understand your problem. What kind of files would you like to monitor?
---
### Author:  [@droidus](https://discuss.elastic.co/u/droidus)
#### Post date: [November 12, 2020, 7:12pm UTC](https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583/3 "2020-11-12T19:12:56Z")
I figured it out. I was monitoring /var/log/_.log, and was trying to figure out why files like syslog were not being picked up.
Is there a way to monitor inside of directories too, like /var/log/apt/_?
---
### Author:  [@savethebyte](https://discuss.elastic.co/u/savethebyte)
#### Post date: [November 12, 2020, 9:20pm UTC](https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583/4 "2020-11-12T21:20:15Z")
Yes. I recommend you create a separate input. In the inputs section of filebeat.yml, add something like this:
```auto
filebeat.inputs:
- type: log
enabled: true
paths:
- /var/log/apt/*filename*
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 10, 2020, 11:20pm UTC](https://discuss.elastic.co/t/filebeat-running-as-root-but-not-ingesting-all-logs/254583/5 "2020-12-10T23:20:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.