# Monitor folder and new created folders Graylog **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** sidecar, filebeat-windows, winlogbeat\ **Created:** [April 29, 2021, 5:27pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673 "2021-04-29T17:27:30Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [April 29, 2021, 5:27pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/1 "2021-04-29T17:27:31Z")
Hello to all I want to monitor with Graylog + Elasticsearch and entire folder and subfolders. Additionaly, this folder will contain new folders created automatically daily with “month/day” format and, creates a file xxxxxx.log inside. I know that with Filebeat + Sidecar I can monitorice them but, I didn´t know what will be the way or sintax to use. ¿Can anyone help me please? Regards ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 29, 2021, 7:03pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/2 "2021-04-29T19:03:14Z")
Hi @Redytel by “Monitor” you mean, something working as a “watchdog” in this folder and then send a notification to graylog everytime a new file was created? **OR** You want filebeat to send logs from a folder no matter what the name or age is? If you asking for the second one, you just have to add something like this in your filebeat.yml ```auto paths: - /var/log/* ``` Subfolders need to go deeper some levels like `/var/log/*/*/*` If you asking for the first one (I guess not), you’ll need to write this watchdog script and then send log in gelf format. ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [April 30, 2021, 7:48am UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/3 "2021-04-30T07:48:32Z")
Hello Reimlima Sorry for the “bad question”, you are right, I wnat send los from a folder and subfolders. I have test the syntax that you say me like this in filebeat on Windows collector. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/3637d62eda14023427bcca3aaa7426e1371e3ea8.png) I have put this path cause, I want to send logs for the folder EMC and subfolders ¿Is this correct? Many thanks for the help ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 30, 2021, 10:25am UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/4 "2021-04-30T10:25:48Z")
It should work, give it a try. ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [April 30, 2021, 11:15am UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/5 "2021-04-30T11:15:08Z")
I have configured this way 3 hours ago and it doesn´t work. Possible I am configuring something wrong but have no idea if I can try something else ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 30, 2021, 12:06pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/6 "2021-04-30T12:06:55Z")
I’m sorry, tottaly forgot to ask, are you using filebeat or winlogbeat? ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [April 30, 2021, 12:21pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/7 "2021-04-30T12:21:00Z")
I am using Filebeat and Sidecar. If I put path this way, it works ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/7/7c8c320bc4ee8c9315e98cff3a13388531d50b72.png) If I put the way you say me, doesn´t do nothing ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [April 30, 2021, 2:17pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/8 "2021-04-30T14:17:27Z")
Maybe this helps you: > **[Log input | Filebeat Reference \[7.12\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-log.html#input-paths)** ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [May 3, 2021, 5:03pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/9 "2021-05-03T17:03:57Z")
Hello reimlima Thanks your for the links but, I can´t take the logs for that I need. I can´t see the logs in Graylog for all the folders and subfolders. I have test with “_.log", "_.log\*.log” “\*\*” and didn´t work. ¿Can you say me something else that can help me? Many thanks ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [May 3, 2021, 9:46pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/10 "2021-05-03T21:46:02Z")
Hi, Can you paste your configuration here? ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [May 4, 2021, 12:11pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/11 "2021-05-04T12:11:12Z")
Sure My configuration is very easy at this moment, is default changing only this patch ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/c/c8bc055a067cec69cd6f371973a2b91ebba9cac5.png) ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [May 4, 2021, 4:46pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/12 "2021-05-04T16:46:02Z")
this configuration came from your Graylog UI or from the server you’re trying to send those logs? ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [May 4, 2021, 4:59pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/13 "2021-05-04T16:59:11Z")
This is the Filebeat on Windows collector configuration that I have active to send logs from the desired server to Graylog. ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [May 4, 2021, 7:03pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/14 "2021-05-04T19:03:52Z")
ok, so… these fields: ```auto fields.collector_node_id: ${sidecar.nodeName} fields.gl2_source_collector: ${sidecar.nodeId} ``` You see it this way only in your Graylog UI in the path `system/sidecars/configuration/edit` Once those values are “internal variables” controled by graylog, in the server the fields `${sidecar.nodeName}` and `${sidecar.nodeId}` are replaced by the server name and the uniq ID graylog add to it. If you can see this in your server, it’s wrong. The best way is to leave graylog handle this config file instead of do it manually. ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [May 11, 2021, 4:07pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/15 "2021-05-11T16:07:03Z")
Hello reimlima Sorry for the late response but I was out of work some days If it helps you, I will let you know some probes that I have made. Configuring this way, I can send logs from one subfolders of C: or two subfolders of C: to Graylog or more… ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/efc7547f0cfe82b2bdd3666c5ed76b547b099cea.png) But in any case, I can´t send logs of subfolders taking this syntax and applying it to path if I take the Folder “EMC” and want to send logs for subfolders. ¿It will help us to know what is wrong in the path configuration? The internal variabes that you are saying, I see in the UI (connecting to Graylog management IP) and, taking collector configuration. ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [May 11, 2021, 4:45pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/16 "2021-05-11T16:45:36Z")
Hi, does your logs in EMC folder have the extension “.log”? ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [May 11, 2021, 4:58pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/17 "2021-05-11T16:58:05Z")
> [@reimlima](#): > > does your logs in EMC folder have the extension “.log”? Hi Yes, I will copy an image of the path ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/fc22ade957e11f392fd1f679adba6006e691306b.png) Inside the repository folder, there is one file with .log extension, same that are in the EMC root folder ---
**Author:** ![reimlima](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/reimlima/32/16254_2.png) [@reimlima](https://community.graylog.org/u/reimlima)\ **Post date:** [May 11, 2021, 5:24pm UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/18 "2021-05-11T17:24:55Z")
@Redytel just saw in your picture that you logfiles have 1KB of size. They are, probably, empty. Your filebeat isn’t sending data to graylog because there’s not to be sent. Have you ever consider make a double-check to ensure that you Storage is able to write in those files? Or if log messages are been supressed in the source by some configuration or so? ---
**Author:** ![Redytel](https://avatars.discourse-cdn.com/v4/letter/r/e274bd/32.png) [@Redytel](https://community.graylog.org/u/Redytel)\ **Post date:** [May 18, 2021, 11:30am UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/19 "2021-05-18T11:30:48Z")
Hello Reimlima I have solved at this time this “mistake”, the logs are not empty but, after you say this, we have write more in the logs to grow up space to 6KB and now, the logs are read with Graylog. I leave the solution here cause, maybe it will be helpful for anyone. Many thanks for your help, regards ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 1, 2021, 11:31am UTC](https://community.graylog.org/t/monitor-folder-and-new-created-folders-graylog/19673/20 "2021-06-01T11:31:17Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.