# Info No Non-zero Metrics in the Last 30s Message in Filebeat

The "Info No Non-zero Metrics in the Last 30s" message in Filebeat indicates that Filebeat hasn't collected or processed any log data within the last 30 seconds. This message is usually part of the internal metrics reporting and isn't necessarily an error but rather an informational log indicating that no log entries were processed or that Filebeat wasn't able to read any data.

Here are some common reasons for this message and steps to troubleshoot:

### **1. Verify Log Files and Paths**

Ensure that Filebeat is correctly configured to read from the specified log file paths.

- **Check Filebeat Configuration:**
    - Open your Filebeat configuration file (`filebeat.yml`) and verify that the paths defined under `filebeat.inputs` are correct.
    - For example:
        
        ```yaml
        filebeat.inputs:
          - type: log
            paths:
              - /path/to/your/logfile.log
        ```
        
- **Verify File Access:**
    - Ensure that Filebeat has the necessary permissions to read the log files.

### **2. Check File Permissions**

Verify that the file permissions are set correctly, and Filebeat can access the log files.

- **On Linux:**
    
    ```bash
    ls -l /path/to/your/logfile.log
    ```
    
- **On Windows:**
Check the file properties and permissions.

### **3. Ensure Logs Are Being Written**

Ensure that the log files are being written to and are not empty.

- **Check Log File Size:**
    - Verify that the log file is not empty and is being updated.

### **4. Check Filebeat Service Status**

Ensure that the Filebeat service is running correctly.

- **On Linux:**
    
    ```bash
    sudo systemctl status filebeat
    ```
    
- **On Windows:**
Check the service status in the Services app or use PowerShell:
    
    ```powershell
    Get-Service filebeat
    ```
    

### **5. Review Filebeat Logs**

Check Filebeat's own logs for any additional errors or warnings that might indicate a problem.

- **On Linux:**
    
    ```bash
    sudo tail -f /var/log/filebeat/filebeat.log
    ```
    
- **On Windows:**
Review the logs in the location specified by the `logging` configuration in `filebeat.yml`, or use the Event Viewer.

### **6. Filebeat Configuration Example**

Ensure your configuration is correctly set to capture the logs you intend to monitor. A basic example configuration might look like this:

```yaml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /path/to/your/logfile.log
    exclude_files: ['.gz$']

output.elasticsearch:
  hosts: ["localhost:9200"]

```

### **7. Restart Filebeat**

After making any changes to the configuration or verifying permissions, restart Filebeat to apply the changes.

- **On Linux:**
    
    ```bash
    sudo systemctl restart filebeat
    ```
    
- **On Windows:**
    
    ```powershell
    Restart-Service filebeat
    ```
    

### **8. Ensure Proper Filebeat Version**

Ensure you are using a version of Filebeat that is compatible with your Elasticsearch and Logstash versions.

### **Summary**

- Verify the log file paths and ensure they are correct and accessible.
- Check that Filebeat has the necessary permissions to read the log files.
- Ensure that logs are being written to the files.
- Review Filebeat logs for any errors or warnings.
- Restart Filebeat after making any configuration changes.

If you follow these steps and the issue persists, you might want to further investigate the specific context of the logs or consider reaching out to the Elastic community for more targeted help.