# Filebeats shipping outdated logs or simply not working

**URL:** <https://discuss.elastic.co/t/filebeats-shipping-outdated-logs-or-simply-not-working/361204>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 11, 2024, 12:38am UTC](https://discuss.elastic.co/t/filebeats-shipping-outdated-logs-or-simply-not-working/361204 "2024-06-11T00:38:36Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![aklenfan](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@aklenfan](https://discuss.elastic.co/u/aklenfan)\
**Post date:** [June 11, 2024, 12:38am UTC](https://discuss.elastic.co/t/filebeats-shipping-outdated-logs-or-simply-not-working/361204/1 "2024-06-11T00:38:36Z")

</div>

Hey team,

We're using Filebeats 7.11.1 (via a Graylog sidecar installation) to send logs from a Windows server to Graylog. However, our current configuration is shipping logs that are months or a year old, despite our server only receiving daily/weekly logs. As a result, Filebeats isn't capturing most of our daily logs. Here's the configuration:

```auto
# Needed for Graylog
fields_under_root: true
fields.collector_node_id: ${sidecar.nodeName}
fields.gl2_source_collector: ${sidecar.nodeId}

output.logstash:
  hosts: ["192.168.1.1:514"]
path:
  data: ${sidecar.spoolDir!"C:\\Program Files\\Graylog\\sidecar\\cache\\filebeat"}\data
  logs: ${sidecar.spoolDir!"C:\\Program Files\\Graylog\\sidecar"}\logs
tags:
  - windows
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - D:\path\to\logs\*\*\*\*\*\*\*.log
      - D:\path\to\otherlogs\1\2\3\*\*\*.log
      - D:\path\to\otherlogs\*\*\*\*\*\*\*\*.log

```

When adding the following flags, Filebeats stops working. We only want to ship logs written within the past 2 weeks:

```auto
scan_frequency: 60s
close_inactive: 336h
ignore_older: 337h

```

Apologies if this has been answered somewhere else. I'm new to filebeats and have tried finding the answer to no resolve. Thanks!