# Not finding my log file

**URL:** <https://discuss.elastic.co/t/not-finding-my-log-file/37726>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 22, 2015, 2:35am UTC](https://discuss.elastic.co/t/not-finding-my-log-file/37726 "2015-12-22T02:35:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![OliverBock](https://avatars.discourse-cdn.com/v4/letter/o/90ced4/32.png) [@OliverBock](https://discuss.elastic.co/u/OliverBock)\
**Post date:** [December 22, 2015, 2:35am UTC](https://discuss.elastic.co/t/not-finding-my-log-file/37726/1 "2015-12-22T02:35:54Z")

</div>

There is some newbie thing I have missed here. I have configured filebeat 1.0.1 on the latest ubuntu 14.04, installed via the [elastic.co repository](https://www.elastic.co/guide/en/beats/libbeat/current/setup-repositories.html). Stripped of comments and blank lines, my filebeat.yml file looks like this:

```
filebeat:
  prospectors:
    -
      paths:
        - /var/log/appname/file.log
      input_type: log
  registry_file: /var/lib/filebeat/registry
output:
  logstash:
    hosts: ["logstash.example.com:4018"]
shipper:
logging:
  files:

```

/var/log/appname/file.log is not empty, but nothing turns up on my logstash system, to which I have added this input: (It works with other inputs.)

```
beats {
    port => 4018
    codec => json_lines {}
}

```

/var/lib/filebeat/registry contains just

```
{}

```

which makes me think that it has not found /var/log/appname/file.log, though I can see access it using tail, etc.

filebeat is running as root and using the right .yml file:

```
root 5994 1 0 02:09 pts/2 00:00:00 /usr/bin/filebeat-god -r / -n -p /var/run/filebeat.pid -- /usr/bin/filebeat -c /etc/filebeat/filebeat.yml
root 5995 5994 0 02:09 pts/2 00:00:00 /usr/bin/filebeat -c /etc/filebeat/filebeat.yml

```

Any ideas?

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [December 22, 2015, 1:11pm UTC](https://discuss.elastic.co/t/not-finding-my-log-file/37726/2 "2015-12-22T13:11:41Z")

</div>

can you try to delete the registry file and run filebeat with debug output:

```
filebeat -e -v -c /etc/filebeat.yml -d '*'

```

The -d option enabled all debug selectors. If output is too noise you can try to run with '-v -e' only.

---

<div class="post-metadata">

**Author:** ![OliverBock](https://avatars.discourse-cdn.com/v4/letter/o/90ced4/32.png) [@OliverBock](https://discuss.elastic.co/u/OliverBock)\
**Post date:** [December 23, 2015, 12:37am UTC](https://discuss.elastic.co/t/not-finding-my-log-file/37726/3 "2015-12-23T00:37:24Z")

</div>

Hi Steffen,

Thanks for that. With the help of the debugging output I realised that I had failed to open a hole in a firewall that filebeat needed in order to get to logstash. I focused on the registry file because I saw no errors for filebeat in syslog, and because I didn't expect it to be empty.

Regards,  
Oliver

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:57pm UTC](https://discuss.elastic.co/t/not-finding-my-log-file/37726/4 "2017-07-05T21:57:18Z")

</div>