# Filebeat struggles **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [August 3, 2020, 8:43am UTC](https://discuss.elastic.co/t/filebeat-struggles/243523 "2020-08-03T08:43:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![vladtepes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladtepes/32/64982_2.png) [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Post date:** [August 3, 2020, 8:43am UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/1 "2020-08-03T08:43:31Z")
I must say, that I am confident it is something simple, but am struggling to make the iis module work in filebeat. 😕 After you enable the iis module and set a custom path, it is throwing an error that > Blockquote > filebeat\modules.d\iis.yml', error invalid config: yaml: line 11: found unknown escape character > /\> Blockquote Additionally, I cannot understand as a concept how the paths work. We have a path we can declare in filebeat.yml directly. If we use only the iis module - do we need to declare the same paths there? If we use a module and a custom log file we want to send to a different ingest pipeline (to parse a special multiline log) - is this possible? Only in filebeat there is a space.id and index template we can declare, but I did not find anything in documentation about it working with the iis module. Ingest pipelines is also something not clear - can they be explicitly declared somehow? Because the log type itself has a different schema, so I don't get how will it be processed by the same pipeline... ---
**Author:** ![fgjensen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fgjensen/32/62320_2.png) [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Post date:** [August 3, 2020, 8:50am UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/2 "2020-08-03T08:50:58Z")
Hi @vladtepes, Could you share your iis module configuration? To answer the first question you should not set the path in both the filebeat.yml and the iis.module. The best approach is to isolate all configuration in the specific modules and enable the modules. ---
**Author:** ![vladtepes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladtepes/32/64982_2.png) [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Post date:** [August 3, 2020, 9:24am UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/3 "2020-08-03T09:24:03Z")
Hi @fgjensen, thank you for replying! Yes, that is how I thought too that the path should be declared only once, but then this syntax error made me think I am doing smth wrong. This is what I have in the IIS module YML: > Blockquote - module: iis access: enabled: true var.paths: 'X:\IISLogs\_\_.log' error: enabled: true var.paths: 'Y:\httpERRORLOG\*.log' ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/1/21fdc3321f60a5d48fec6f28d65661206ad3c30e.png) ---
**Author:** ![fgjensen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fgjensen/32/62320_2.png) [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Post date:** [August 3, 2020, 10:03am UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/4 "2020-08-03T10:03:30Z")
I think the correct syntax on Windows is `var.paths: ["X:/IISLogs/*/*.log"]`. If you have not changed the default logging directories the module actually sets the default directories, so you do not have to configure the paths. You can test the configuration with `filebeat test config`. This is a great way to solve configuration problems fast. ` ---
**Author:** ![vladtepes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vladtepes/32/64982_2.png) [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Post date:** [August 3, 2020, 10:13am UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/5 "2020-08-03T10:13:59Z")
> [@fgjensen](#): > > filebeat test config It is strange, but this is not checked by this command, since it comes out as "Config OK" for me. This is the most frustrating about it. The syntax you refer to I have already tried, as I saw it in the documentation, but it still fails after some time and in the filebeat log I can see the syntax error in the iis.yml. 😕 ---
**Author:** ![fgjensen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fgjensen/32/62320_2.png) [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Post date:** [August 3, 2020, 12:24pm UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/6 "2020-08-03T12:24:04Z")
Strange - could you set the log level to debug in filebeat.yml and post the results, when the module has failed? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 31, 2020, 2:24pm UTC](https://discuss.elastic.co/t/filebeat-struggles/243523/7 "2020-08-31T14:24:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.