# Help constructing yaml file **URL:** \ **Category:** Beats\ **Tags:** windows, filebeat\ **Created:** [October 23, 2023, 8:57am UTC](https://discuss.elastic.co/t/help-constructing-yaml-file/345550 "2023-10-23T08:57:24Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Emorta](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emorta/32/123256_2.png) [@Emorta](https://discuss.elastic.co/u/Emorta)\ **Post date:** [October 23, 2023, 8:57am UTC](https://discuss.elastic.co/t/help-constructing-yaml-file/345550/1 "2023-10-23T08:57:24Z")
Hello, I'm trying to monitor Windows events (security only) and DHCP event logs (files). The first part works well; logs are collected and shipped, and it has been running for 3 months. I now want to add file logging for DHCP. The log files are located in the paths %windir%\System32\DHCP\DhcpSrvLog-\*.log. However, when I add the following configuration: filebeat.inputs: - type: log enabled: true paths: - %windir%\System32\DHCP\DhcpSrvLog-\*.log The service fails to start, and I'm unsure why. The service is running as "Local System." should i not be able to run both Windows event logging and File logging in the same yaml file? ---
**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\ **Post date:** [October 23, 2023, 9:25am UTC](https://discuss.elastic.co/t/help-constructing-yaml-file/345550/2 "2023-10-23T09:25:05Z")
Hi @Emorta, Do you have any errors or warnings in the logs at all? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 20, 2023, 11:25am UTC](https://discuss.elastic.co/t/help-constructing-yaml-file/345550/3 "2023-11-20T11:25:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.