# Filebeats not harvesting new file

**URL:** <https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 8, 2019, 4:08pm UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400 "2019-01-08T16:08:41Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![NickRoper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickroper/32/39608_2.png) [@NickRoper](https://discuss.elastic.co/u/NickRoper)\
**Post date:** [January 8, 2019, 4:08pm UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400/1 "2019-01-08T16:08:42Z")

</div>

Hi, I'm new to the ELK stack so apologies if this is a stupid question.

I've downloaded and installed the following:

- elasticsearch-6.5.4
- kibana-6.5.4
- logstash-6.5.4
- filebeats-6.54

I have everything installed and have successfully indexed the example apache logs into elasticsearch & kibana by using filebeats. In the

```
filebeat.inputs:
- type: log

  # Change to true to enable this input configuration.
  enabled: true

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /Users/nick.roper/elasticsearch/data/apache-test/*

```

Initially the directory just contained an example 'logs' file and this was processed fine.

I then created a new file in the same directory and expected it to be found and processed by filebeats, but it doesn't appear in Kibana, even after several minutes. Am I missing something?

Thanks

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [January 9, 2019, 7:38pm UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400/2 "2019-01-09T19:38:13Z")

</div>

@NickRoper Is there any error in the Filebeat log? Does Filebeat has the permission to read that file?

---

<div class="post-metadata">

**Author:** ![NickRoper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickroper/32/39608_2.png) [@NickRoper](https://discuss.elastic.co/u/NickRoper)\
**Post date:** [January 9, 2019, 10:07pm UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400/3 "2019-01-09T22:07:31Z")

</div>

Hi @pierhugues, thanks for getting back.

I can't see anything in the logs, but I did try restarting Filebeat and then it started harvesting from the new file and picking up any new entries OK.

I originally added the new file after filebeat had been started the first time, so maybe it finds any files that match the pattern when it starts up and then only watches those - could that be the case?

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [January 11, 2019, 2:03am UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400/4 "2019-01-11T02:03:17Z")

</div>

That should not be the case, we periodically scan the disk for new files, if you start filebeat with `-e -d "*"` we should a more information when it discover files or why its not considering the file to harvesting.

---

<div class="post-metadata">

**Author:** ![NickRoper](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickroper/32/39608_2.png) [@NickRoper](https://discuss.elastic.co/u/NickRoper)\
**Post date:** [January 11, 2019, 5:58am UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400/5 "2019-01-11T05:58:58Z")

</div>

Thanks @pierhugues - useful to know about those flags and I could see it scanning the files. It seems to be working OK now, so I'm not sure what the issue was previously, but many thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 8, 2019, 5:59am UTC](https://discuss.elastic.co/t/filebeats-not-harvesting-new-file/163400/6 "2019-02-08T05:59:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
