🚨 Filebeat Error: 'No paths were defined for input' — Cause, Fix, and Troubleshooting Guide

What this error means

A log or filestream input must declare at least one path to harvest. If an input block has no usable paths, Filebeat cannot initialize it and the crawler fails to start:

Exiting: Failed to start crawler: starting input failed: Error while initializing input: No paths were defined for input accessing 'filebeat.inputs.0' (source:'/etc/filebeat/filebeat.yml')

The most common cause is not a truly missing paths key but a YAML indentation or structure mistake that makes paths land outside the input, or an empty/commented-out list. Because the input cannot be built, the whole crawler aborts and Filebeat exits. The accessing 'filebeat.inputs.N' fragment tells you exactly which input block is at fault.

How the agent reports it

• No paths were defined for input accessing 'filebeat.inputs.N' and Filebeat exits.
• The named index N points at a specific input block.
• Config “looks” complete but paths is empty, misindented, or commented out.
• Happens after editing inputs or converting log inputs to filestream.

Checking the agent configuration

Print the fully-resolved config and inspect the offending input index:

filebeat export config -c /etc/filebeat/filebeat.yml
filebeat test config -c /etc/filebeat/filebeat.yml

Run in the foreground to see which input index fails:

filebeat -e -c /etc/filebeat/filebeat.yml -d "crawler,input"

Agent configuration causes

• Empty or commented paths — the list has no entries.
• Indentation error — paths is not nested under the input’s - list item.
• Wrong key — using path: (singular) instead of paths:.
• Variable that resolved to nothing — a templated path that expanded empty.
• Merged configs where an included input file lost its paths.

Step-by-step resolution

Add a valid, correctly-indented paths list under the input:

filebeat.inputs:
  - type: filestream
    id: app-logs
    enabled: true
    paths:
      - /var/log/app/*.log
      - /var/log/app/**/*.log

Watch the indentation — paths and its entries must sit under the - input item, and use paths: (plural), not path:. If a glob may legitimately match nothing at start, that is fine; the error is specifically about no paths being defined, not about zero current matches.

Validate and restart:

filebeat test config && systemctl restart filebeat
journalctl -u filebeat -f | grep -i 'harvester\|input'

Safer agent defaults

• Zero matching files is allowed; the error is about a missing paths definition, not empty globs.
• path: (singular) is silently ignored — it must be paths:.
• A misindented paths attaches to the wrong node and reads as undefined — check YAML structure.
• With included input files, ensure each carries its own paths.

Related agent errors

• Filebeat Error: ‘Failed to start crawler’
• Filebeat Error Guide: ‘Error creating runner from config’
• Filebeat Error Guide: ‘error loading config file … yaml: line X’