🚨 Filebeat Error: 'No paths were defined for input' — Cause, Fix, and Troubleshooting Guide

Overview

A log or filestream input must declare at least one path to harvest. If an input block has no usable paths, Filebeat cannot initialize it and the crawler fails to start:

Exiting: Failed to start crawler: starting input failed: Error while initializing input: No paths were defined for input accessing 'filebeat.inputs.0' (source:'/etc/filebeat/filebeat.yml')

The most common cause is not a truly missing paths key but a YAML indentation or structure mistake that makes paths land outside the input, or an empty/commented-out list. Because the input cannot be built, the whole crawler aborts and Filebeat exits. The accessing 'filebeat.inputs.N' fragment tells you exactly which input block is at fault.

Symptoms

• No paths were defined for input accessing 'filebeat.inputs.N' and Filebeat exits.
• The named index N points at a specific input block.
• Config “looks” complete but paths is empty, misindented, or commented out.
• Happens after editing inputs or converting log inputs to filestream.

Common Root Causes

• Empty or commented paths — the list has no entries.
• Indentation error — paths is not nested under the input’s - list item.
• Wrong key — using path: (singular) instead of paths:.
• Variable that resolved to nothing — a templated path that expanded empty.
• Merged configs where an included input file lost its paths.

How to diagnose

Print the fully-resolved config and inspect the offending input index:

filebeat export config -c /etc/filebeat/filebeat.yml
filebeat test config -c /etc/filebeat/filebeat.yml

Run in the foreground to see which input index fails:

filebeat -e -c /etc/filebeat/filebeat.yml -d "crawler,input"

Fixes

Add a valid, correctly-indented paths list under the input:

filebeat.inputs:
  - type: filestream
    id: app-logs
    enabled: true
    paths:
      - /var/log/app/*.log
      - /var/log/app/**/*.log

Watch the indentation — paths and its entries must sit under the - input item, and use paths: (plural), not path:. If a glob may legitimately match nothing at start, that is fine; the error is specifically about no paths being defined, not about zero current matches.

Validate and restart:

filebeat test config && systemctl restart filebeat
journalctl -u filebeat -f | grep -i 'harvester\|input'

What to watch out for

• Zero matching files is allowed; the error is about a missing paths definition, not empty globs.
• path: (singular) is silently ignored — it must be paths:.
• A misindented paths attaches to the wrong node and reads as undefined — check YAML structure.
• With included input files, ensure each carries its own paths.

Related

• Filebeat Error: ‘Failed to start crawler’
• Filebeat Error Guide: ‘Error creating runner from config’
• Filebeat Error Guide: ‘error loading config file … yaml: line X’