# Metricbeat on NGINX reads only access.log and error.log **URL:** \ **Category:** Metrics\ **Created:** [March 12, 2020, 9:36am UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300 "2020-03-12T09:36:40Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![carmine.fabrizio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmine.fabrizio/32/71788_2.png) [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Post date:** [March 12, 2020, 9:36am UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/1 "2020-03-12T09:36:40Z")
Hi all, I'm having a strange behavior, my metricbeat is reading only - /var/log/nginx/access.log - /var/log/nginx/error.log I have different .log file per each location on my NGINX. this is what I configured in my /etc/metricbeat/modules.d/nginx.yml ``` # Module: nginx # Docs: https://www.elastic.co/guide/en/beats/metricbeat/7.6/metricbeat-module-nginx.html - module: nginx access: enabled: true var.paths: ["/var/log/nginx/*access.log*"] error: enabled: true var.paths: ["/path/to/log/nginx/*error.log*"] metricsets: - stubstatus period: 10s # Nginx hosts hosts: ["http://127.0.0.1"] # Path to server status. Default server-status server_status_path: "basic_status" ``` any help on this? Thanks! ---
**Author:** ![afgomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afgomez/32/59274_2.png) [@afgomez](https://discuss.elastic.co/u/afgomez)\ **Post date:** [March 12, 2020, 9:46am UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/2 "2020-03-12T09:46:04Z")
Hi @carmine.fabrizio, Could you post a listing of your `/var/log/nginx/` folder? ---
**Author:** ![carmine.fabrizio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmine.fabrizio/32/71788_2.png) [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Post date:** [March 12, 2020, 10:39am UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/3 "2020-03-12T10:39:12Z")
> [@afgomez](#): > > `/var/log/nginx/` ``` root@dev-nginx01:[~]# ls /var/log/nginx/ access.log error.log es_access.log es_error.log root@dev-nginx01:[~]# ``` Thanks ---
**Author:** ![afgomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afgomez/32/59274_2.png) [@afgomez](https://discuss.elastic.co/u/afgomez)\ **Post date:** [March 12, 2020, 11:07am UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/4 "2020-03-12T11:07:49Z")
Thanks for the listing! I re-read your question again and I saw that you mentioned `metricbeat`. Logs are ingested into the elastic stack with `filebeat`, so maybe the issue is there. Could you check for me if `filebeat` is configured, and what is the nginx module configuration? ---
**Author:** ![carmine.fabrizio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmine.fabrizio/32/71788_2.png) [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Post date:** [March 12, 2020, 11:24am UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/5 "2020-03-12T11:24:29Z")
filebeat does not read neither ``` Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.866-0400 INFO log/input.go:152 Configured paths: [/var/log/nginx/access.log*] Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.867-0400 INFO log/input.go:152 Configured paths: [/var/log/nginx/error.log*] Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.874-0400 INFO log/input.go:152 Configured paths: [/var/log/messages* /var/log/syslog*] Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.876-0400 INFO log/input.go:152 Configured paths: [/var/log/auth.log* /var/log/secure*] Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.876-0400 INFO crawler/crawler.go:106 Loading and starting Inputs completed. Enabled inputs: 0 Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.876-0400 INFO cfgfile/reload.go:171 Config reloader started Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.880-0400 INFO log/input.go:152 Configured paths: [/var/log/nginx/access.log*] Mar 12 07:21:39 dev-nginx01.isoftbet.com filebeat[19051]: 2020-03-12T07:21:39.880-0400 INFO log/input.go:152 Configured paths: [/var/log/nginx/error.log*] ``` this is my filebeat.yml ``` - type: log # Change to true to enable this input configuration. enabled: false # Paths that should be crawled and fetched. Glob based paths. paths: - /var/log/*.log - /var/log/nginx/* ``` also ``` root@dev-nginx01:[~]# filebeat modules list Enabled: nginx system ``` ---
**Author:** ![afgomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afgomez/32/59274_2.png) [@afgomez](https://discuss.elastic.co/u/afgomez)\ **Post date:** [March 12, 2020, 12:46pm UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/6 "2020-03-12T12:46:11Z")
I think we are getting close. The first two lines on your output mention: ```auto Mar 12 07:21:39 [...] Configured paths: [/var/log/nginx/access.log*] Mar 12 07:21:39 [...] Configured paths: [/var/log/nginx/error.log*] ``` The patterns there should be `/var/log/nginx/*access.log*` and `/var/log/nginx/*error.log*` so the `es_` prefixed files in the listing that you shared with me will be included. Next to your `filebeat.yml` there should be a `modules.d/nginx.yml`. If they are not set already, try adding the necessary `var.paths` configuration there. ```auto # Module: nginx # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.3/filebeat-module-nginx.html - module: nginx # Access logs access: enabled: true var.paths: ["/var/log/nginx/*access.log*/"] # Error logs error: enabled: true var.paths: ["/var/log/nginx/*error.log*"] ``` Let me know ---
**Author:** ![carmine.fabrizio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carmine.fabrizio/32/71788_2.png) [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Post date:** [March 12, 2020, 5:42pm UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/7 "2020-03-12T17:42:56Z")
Yup, it works thanks a lot! ---
**Author:** ![afgomez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/afgomez/32/59274_2.png) [@afgomez](https://discuss.elastic.co/u/afgomez)\ **Post date:** [March 12, 2020, 5:54pm UTC](https://discuss.elastic.co/t/metricbeat-on-nginx-reads-only-access-log-and-error-log/223300/8 "2020-03-12T17:54:59Z")