This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Can’t read log files from network volumes Too many open file handlers »
Elastic Docs ›Filebeat Reference [master] ›Troubleshoot ›Common problems

Filebeat isn’t collecting lines from a file

edit

Filebeat isn’t collecting lines from a file

edit

Filebeat might be incorrectly configured or unable to send events to the output. To resolve the issue:

  • If using modules, make sure the var.paths setting points to the file. If configuring an input manually, make sure the paths setting is correct.
  • Verify that the file is not older than the value specified by ignore_older. ignore_older is disable by default so this depends on the value you have set. You can change this behavior by specifying a different value for ignore_older.

  • Make sure that Filebeat is able to send events to the configured output. Run Filebeat in debug mode to determine whether it’s publishing events successfully:

    ./filebeat -c config.yml -e -d "*"
« Can’t read log files from network volumes Too many open file handlers »