# Journalbeat can't open a log file
**URL:** https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116
**Category:** Beats
**Tags:** journalbeat
**Created:** [August 24, 2020, 1:10pm UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116 "2020-08-24T13:10:12Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@DenProg](https://discuss.elastic.co/u/DenProg)
#### Post date: [August 24, 2020, 1:10pm UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116/1 "2020-08-24T13:10:12Z")
Hi.
I describe specific log file in the config as it's written in the docs:
```auto
journalbeat.inputs:
- paths:
- "/var/log/syslog"
```
This file is present, but Journalbeat can't open it for some reason:
```auto
авг 24 15:53:29 computer journalbeat[28297]: 2020-08-24T15:53:29.469+0300 INFO instance/beat.go:419 journalbeat stopped.
авг 24 15:53:29 computer journalbeat[28297]: 2020-08-24T15:53:29.469+0300 ERROR instance/beat.go:951 Exiting: error creating reader for journal: reader.go:120: failed to open journal file /var/log/syslog (path=/var/log/syslog)
авг 24 15:53:29 computer journalbeat[28297]: failed to open journals in paths ["/var/log/syslog"]: bad message
авг 24 15:53:29 computer journalbeat[28297]: Exiting: error creating reader for journal: reader.go:120: failed to open journal file /var/log/syslog (path=/var/log/syslog)
авг 24 15:53:29 computer journalbeat[28297]: failed to open journals in paths ["/var/log/syslog"]: bad message
```
What's wrong? How to work with specific files?
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [August 25, 2020, 10:32am UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116/2 "2020-08-25T10:32:39Z")
Hi @DenProg 🙂
I'm not expert in Journalbeat but... can you try to use a path like `"/var/log/syslog/*"` I think it might be an error in Journalbeat docs.
If it doesn't work, can you specify directly a file by its filename? Just to make the check.
Thanks!
---
### Author:  [@DenProg](https://discuss.elastic.co/u/DenProg)
#### Post date: [August 25, 2020, 10:36am UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116/3 "2020-08-25T10:36:53Z")
Hi @[Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
/var/log/syslog is a file, not a directory. I tried other files with the same result.
---
### Author:  [@Mario\_Castro](https://discuss.elastic.co/u/Mario_Castro)
#### Post date: [August 25, 2020, 10:42am UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116/4 "2020-08-25T10:42:50Z")
Ok so maybe it's something regarding the "format" of the data inside the file. The error happens when trying to "create a systemd Journal from the file" as far as I can see in the code. Can you check that the format is the one expected from systemd [https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html](https://www.freedesktop.org/software/systemd/man/systemd-journald.service.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 22, 2020, 12:42pm UTC](https://discuss.elastic.co/t/journalbeat-cant-open-a-log-file/246116/5 "2020-09-22T12:42:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.