# Filebeat stop harvesting **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 17, 2020, 1:57am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553 "2020-02-17T01:57:43Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Charles\_Yuliansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles_yuliansen/32/45664_2.png) [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Post date:** [February 17, 2020, 1:57am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/1 "2020-02-17T01:57:43Z")
I've configuring filebeat, logstash, elasticsearch. it works pretty well. But for some reason filebeat will stop harvesting log file. The file will be generated **everyday**. I've try this for few times at it always happened at certain time. for example: i run it at **12 Oct** , until it will harvest the file that generated on **13 Oct** and **14 Oct** , but for some reason it wont harvesting on _ **15 Oct** _. Its pretty weird so i check the logstash but the service still running, then i check the filebeat, it still running but it not harvesting file on **_15 Oct_.** filebeat.yml: ```auto filebeat.inputs: - type: log paths: - c:/inetpub/logs/LogFiles/W3SVC3/*.log output.logstash: hosts: ["10.64.2.246:5044"] ``` run : ```auto .\filebeat.exe -c filebeat.YML -e -d "*" ``` any respond or suggestions will be appreciated ---
**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\ **Post date:** [February 17, 2020, 6:28am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/2 "2020-02-17T06:28:44Z")
@Charles_Yuliansen - It is difficult to tell what the problem could be without any debug logs from Filebeat. I see that you are already running Filebeat with debug logging enabled on all selectors, that would be great if you could share with us the logs (from the moment where you start Filebeat). I see that you are using Filebeat on Windows, you could be facing an issue related to the file handlers and the Windows file rotation. You can read more about this [here](https://www.elastic.co/guide/en/beats/filebeat/current/open-file-handlers.html). Could you also tell us if the logs are stored in network volumes? There are some [known issues](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-network-volumes.html) with network volumes. Thank you. ---
**Author:** ![Charles\_Yuliansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles_yuliansen/32/45664_2.png) [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Post date:** [March 2, 2020, 4:13am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/3 "2020-03-02T04:13:43Z")
Hi there thank you so much for your responds, but seems i dont get it what should i do next. The log file generated everyday, and for first few day filebeat did well by reading new file each day, but for some reason it stop reading new file (the log only shown that nothing changes from the previous file which is obvious because it generated everyday) after certain day. ---
**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\ **Post date:** [March 3, 2020, 2:46am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/4 "2020-03-03T02:46:11Z")
@Charles_Yuliansen - There are a couple of known issues/limitations in Windows that you should be aware of: - [Can’t read log files from network volumes](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-network-volumes.html) - [Open file handlers cause issues with Windows file rotation](https://www.elastic.co/guide/en/beats/filebeat/current/windows-file-rotation.html) To find-out what's going on, it would be good to run Filebeat with debug logging: - `filebeat -e -d "*"` Once the issue happens, you can attach the debug logs. I am also wondering which Filebeat version you are currently using? ---
**Author:** ![Charles\_Yuliansen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/charles_yuliansen/32/45664_2.png) [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Post date:** [March 10, 2020, 2:29am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/5 "2020-03-10T02:29:27Z")
Hi there I'm running filebeat 7.4.2. Is there something that I can use to stop filebeat reading from the beginning of the folder again? I mean file generated everyday in the folder, and if i have the file from 1 January 2019 and the latest file is 6 March 2020 it still checking if 1 January 2019 have any change which is impossible in my case. Thank you so much for your reply and advice. ---
**Author:** ![ropc](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ropc/32/47022_2.png) [@ropc](https://discuss.elastic.co/u/ropc)\ **Post date:** [March 11, 2020, 8:53am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/6 "2020-03-11T08:53:48Z")
@Charles_Yuliansen - I suggest you look into the [following parameters](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html): - `ignore_older`, `close_inactive` and `clean_inactive`. Configuring these parameters should prevent Filebeat from reading the older logs (and will also clean the Filebeat registry file accordingly). Note: if your log files are deleted/renamed, there are some other parameters that you could use (e.g `close_renamed`, etc.) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 8, 2020, 8:53am UTC](https://discuss.elastic.co/t/filebeat-stop-harvesting/219553/7 "2020-04-08T08:53:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.