# Filebeat.yml.rpmnew use?

**URL:** <https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 19, 2018, 9:43am UTC](https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699 "2018-07-19T09:43:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![saisimo02](https://avatars.discourse-cdn.com/v4/letter/s/edb3f5/32.png) [@saisimo02](https://discuss.elastic.co/u/saisimo02)\
**Post date:** [July 19, 2018, 9:43am UTC](https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699/1 "2018-07-19T09:43:35Z")

</div>

Hi,  
I installed recently filebeat, and I would like to edit the yml file to specify this input:  
filebeat.prospectors:

```
- input_type: log

  paths:
    - /path/*.xml
  # scan_frequency: 60s
  document_type: message
  multiline.pattern: '^<measInfo'
  multiline.negate: true
  multiline.match: after

```

I should edit the file filebeat.yml or filebeat.yml.rpmnew?

When I edit filebeat.yml I get this message error :  
\> filebeat.service - filebeat

> ```
> Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled)
> Active: failed (Result: start-limit) since Thu 2018-07-19 11:35:40 CEST; 2s ago
> Docs: https://www.elastic.co/guide/en/beats/filebeat/current/index.html
> Process: 4695 ExecStart=/usr/share/filebeat/bin/filebeat -c /etc/filebeat/filebeat.yml -path.home /usr/share/filebeat -path.config /etc/filebeat -path.data /var/lib/filebeat -path.logs /var/log/filebeat (code=exited, status=1/FAILURE)
> Main PID: 4695 (code=exited, status=1/FAILURE)
> 
> ```

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 19, 2018, 9:01pm UTC](https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699/2 "2018-07-19T21:01:55Z")

</div>

> [@saisimo02](#):
>
> I should edit the file filebeat.yml or filebeat.yml.rpmnew?

filebeat.yml.rpmnew is created by RPM when you update an RPM and have a modified config file. This is to prevent overwriting any changes you have made to a config file. The config the filebeat will read is /etc/filebeat/filebeat.yml.

If filebeat is not starting then you should check the contents of the log file for errors.

When you are making config file changes you can invoke `filebeat test config -e` to smoke test the config file. Additionally you can start Filebeat on the CLI if you want to watch it startup and see any errors on the CLI (`filebeat run -e -d "*"`). But don't do this while the systemd filebeat service is running.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 16, 2018, 9:07pm UTC](https://discuss.elastic.co/t/filebeat-yml-rpmnew-use/140699/3 "2018-08-16T21:07:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.