# How to detect the absence of a file using filebeat

**URL:** https://discuss.elastic.co/t/how-to-detect-the-absence-of-a-file-using-filebeat/363578
**Category:** Beats
**Tags:** filebeat
**Created:** [July 22, 2024, 4:17pm UTC](https://discuss.elastic.co/t/how-to-detect-the-absence-of-a-file-using-filebeat/363578 "2024-07-22T16:17:57Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Puneet\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneet_singh/32/121459_2.png) [@Puneet\_Singh](https://discuss.elastic.co/u/Puneet_Singh)
#### Post date: [July 22, 2024, 4:17pm UTC](https://discuss.elastic.co/t/how-to-detect-the-absence-of-a-file-using-filebeat/363578/1 "2024-07-22T16:17:57Z")

</div>

Hi All,  
We have a monitoring pipeline available in out infrastructure for monitoring /var/log/messages logs.  
filebeat -\> kafka -\> logstash -\> elasticsearch -\> elastalert.

We are using filebeat 8.0.1 to export system logs to the kafka topic.

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/2/c211b20e51dd250c5358b413b60f77a0695a256e.png)

Now the issue is that there maybe few servers where the /var/log/messages may not be present. So following possibilities may happen:

Scenario A: no logs in the /var/log/messages since last 1 day  
Scenario B: /var/log/messages file is missing

How can we distinguish/detect the scenario A from scenario B? so that i can detect and create an alert for Scenario B using elastalert?

please advice.

---

<div class="post-metadata">

### Author: ![Puneet\_Singh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/puneet_singh/32/121459_2.png) [@Puneet\_Singh](https://discuss.elastic.co/u/Puneet_Singh)
#### Post date: [July 22, 2024, 4:19pm UTC](https://discuss.elastic.co/t/how-to-detect-the-absence-of-a-file-using-filebeat/363578/2 "2024-07-22T16:19:13Z")

</div>

Removed #elastalert

---

<div class="post-metadata">

### Author: ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)
#### Post date: [July 23, 2024, 7:51am UTC](https://discuss.elastic.co/t/how-to-detect-the-absence-of-a-file-using-filebeat/363578/3 "2024-07-23T07:51:28Z")

</div>

Hello Puneet,

My first thought was to use `ls` command as an input, but neither Filebeat nor Elastic Agent support it [yet](https://github.com/elastic/elastic-agent/issues/1237).

Therefore, I would create a cron job on the systems running `ls -ltr --time-style=long-iso /var/log > logfile-ages.log`

This file can then be ingested into Elastic using Filebeat and you can create an alert if the messages file is not found in the documents of the last X minutes.

But maybe someone else has a better idea...

Best regards  
Wolfram