Lofg file not getting picked up from filebeat

[Shubham_Singh]

Hello,

Facing issue where log files are not getting picked up from filebeat in same dir.

files - files1.log (this is not getting picked up)
files-access.log (this file gets picked up)

filebeat config

filebeat.inputs:
- type: log
  enabled: true
  paths:
  - /var/log/*/*/*.log
  - /home/centos/standalone_apps/*/logs/*.log
  input_type: log
  json.keys_under_root: true
  json.add_error_key: true
  json.message_key: message
  reload.enabled: false
  json.overwrite_keys: true
setup.template.settings:
  index.number_of_shards: 1
  index.codec: best_compression
setup.ilm.enabled: false
setup.template.fields: "${path.config}/fields.yml"
setup.template.name: "xyz"
setup.template.pattern: "xyz"
setup.template.enabled: true
setup.template.overwrite: true
logging.level: debug
logging.to_files: true
logging.files:
  path: /var/log/filebeat
  name: filebeat
  keepfiles: 4
  permissions: 0644
http.enabled: true
http.host: xxx
output.elasticsearch:
  hosts: ["xxx:9200"]
  index: "xxx-%{+yyyy.MM.dd}"
# Enable filebeat config reloading
filebeat.config:
  #inputs:
    #enabled: false
    #path: inputs.d/*.yml
    #reload.enabled: true
    #reload.period: 10s
  modules:
    enabled: true
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true
    reload.period: 10s```

[Shubham_Singh]

i can see this when i enabled info logs for filebeat

2022-07-07T12:24:03.993Z WARN [elasticsearch] elasticsearch/client.go:405 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x12b74280, ext:63792793434, loc:(*time.Location)(0x55b6c868e320)}, Meta:null, Fields:{"@version":1,"agent":{"ephemeral_id":"xxx","hostname":"xxx","id":"a2d96088-c200-48b1-9126-ce7525e4d89f","name":"appserver33.qa.engati.local","type":"filebeat","version":"7.14.1"},"app_name":"xxx","ecs":{"version":"1.10.0"},"host":{"name":"xxx"},"input":{"type":"log"},"level":"INFO","level_value":20000,"log":{"file":{"path":"xxx"},"offset":114762},"log_type":"app","logger_name":"xxx","message":"Got call to login global customer with body: AuthDto(username=auto@maildrop.cc, password=8776f108e247ab1e2b323042c049c266407c81fbad41bde1e8dfc1bb66fd267e, domainUrl=xxx)","thread_name":"http-nio-10520-exec-8"}, Private:file.State{Id:"native::25218551-66305", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0007f2d00), Source:"/var/log/*/*/files1.log", Offset:115215, Timestamp:time.Time{wall:0xc0a9d1f7f4491a63, ext:216034578, loc:(*time.Location)(0x55b6c868e320)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x180cdf7, Device:0x10301}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"object mapping for [level] tried to parse field [level] as object, but found a concrete value"}