# Apache module and var.paths not working

**URL:** <https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 8, 2020, 12:52pm UTC](https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725 "2020-05-08T12:52:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hausmeister](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Hausmeister](https://discuss.elastic.co/u/Hausmeister)\
**Post date:** [May 8, 2020, 12:52pm UTC](https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725/1 "2020-05-08T12:52:18Z")

</div>

All,

I'm facing an issue with the apache module paths variable.  
When enabling the module without any customization, filebeat starts as expected sending the default access-log and error.log files to a logstash/eleastic server.  
As soon as I'm adding var.paths in the configuration to also process my other apache logs, filebeat is not able to start.  
The error message is  
"Fileset apache/var is configured but doesn't exist"

The config is:

- module: apache  
access:  
enabled: true  
var.paths: ["/var/log/apache2/_.access"]  
error:  
enabled: true  
var.paths: ["/var/log/apache2/_.err"]

Am I missing something?

Thanks  
René

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [May 10, 2020, 1:38pm UTC](https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725/2 "2020-05-10T13:38:07Z")

</div>

Hey @Hausmeister, welcome to discuss 🙂

Indentation is relevant in Beats configuration, in the case of filebeat modules, vars have to be defined under the fileset, like this:

```auto
- module: apache
  access:
    enabled: true
    var.paths: ['/var/log/apache2/*.access']
  error:
    enabled: true
    var.paths: ['/var/log/apache2/*.err']

```

---

<div class="post-metadata">

**Author:** ![Hausmeister](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Hausmeister](https://discuss.elastic.co/u/Hausmeister)\
**Post date:** [May 11, 2020, 5:41am UTC](https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725/3 "2020-05-11T05:41:53Z")

</div>

Hi @jsoriano,

thanks for your reply.  
I had the asterisks in my config. Due to format limits they were not shown in my post.  
Tested with single quotes as you posted but still not working.  
Receiving the same error message. As from the debug log:  
'May 11 07:41:26 webserver systemd[1]: Started Filebeat sends log files to Logstash or directly to Elasticsearch..  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.216+0200#011INFO#011instance/beat.go:622#011Home path: [/usr/share/filebeat] Config path: [/etc/filebeat] Data path: [/var/lib/filebeat] Logs path: [/var/log/filebeat]  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.218+0200#011DEBUG#011[beat]#011instance/beat.go:674#011Beat metadata path: /var/lib/filebeat/meta.json  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.218+0200#011INFO#011instance/beat.go:630#011Beat ID: 99743ca0-0c4f-477f-8d0d-2d7f6d71c6e1  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.219+0200#011DEBUG#011[processors]#011processors/processor.go:101#011Generated new processors: add\_host\_metadata=[netinfo.enabled=[false], cache.ttl=[5m0s]]  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.220+0200#011DEBUG#011[seccomp]#011seccomp/seccomp.go:117#011Loading syscall filter#011{"seccomp\_filter": {"no\_new\_privs":true,"flag":"tsync","policy":{"default\_action":"errno","syscalls":[{"names":["accept","accept4","access","arch\_prctl","bind","brk","chmod","clock\_gettime","clone","close","connect","dup","dup2","epoll\_create","epoll\_create1","epoll\_ctl","epoll\_pwait","epoll\_wait","exit","exit\_group","fchdir","fchmod","fchown","fcntl","fdatasync","flock","fstat","fstatfs","fsync","ftruncate","futex","getcwd","getdents","getdents64","geteuid","getgid","getpeername","getpid","getppid","getrandom","getrlimit","getrusage","getsockname","getsockopt","gettid","gettimeofday","getuid","inotify\_add\_watch","inotify\_init1","inotify\_rm\_watch","ioctl","kill","listen","lseek","lstat","madvise","mincore","mkdirat","mmap","mprotect","munmap","nanosleep","newfstatat","open","openat","pipe","pipe2","poll","ppoll","pread64","pselect6","pwrite64","read","readlink","readlinkat","recvfrom","recvmmsg","recvmsg","rename","renameat","rt\_sigaction","rt\_sigprocmask","rt\_sigreturn","sched\_getaffinity","sched\_yield","sendfile","sendmmsg","sendmsg","sendto","set\_robust\_list","setitimer","setsockopt","shutdown","sigaltstack","socket","splice","stat","statfs","sysinfo","tgkill","time","tkill","uname","unlink","unlinkat","wait4","waitid","write","writev"],"action":"allow"}]}}}  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.221+0200#011INFO#011[seccomp]#011seccomp/seccomp.go:124#011Syscall filter successfully installed  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.221+0200#011INFO#011[beat]#011instance/beat.go:958#011Beat info#011{"system\_info": {"beat": {"path": {"config": "/etc/filebeat", "data": "/var/lib/filebeat", "home": "/usr/share/filebeat", "logs": "/var/log/filebeat"}, "type": "filebeat", "uuid": "99743ca0-0c4f-477f-8d0d-2d7f6d71c6e1"}}}  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.222+0200#011INFO#011[beat]#011instance/beat.go:967#011Build info#011{"system\_info": {"build": {"commit": "d57bcf8684602e15000d65b75afcd110e2b12b59", "libbeat": "7.6.2", "time": "2020-03-26T05:23:38.000Z", "version": "7.6.2"}}}  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.222+0200#011INFO#011[beat]#011instance/beat.go:970#011Go runtime info#011{"system\_info": {"go": {"os":"linux","arch":"amd64","max\_procs":1,"version":"go1.13.8"}}}  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.223+0200#011INFO#011[beat]#011instance/beat.go:974#011Host info#011{"system\_info": {"host": {"architecture":"x86\_64","boot\_time":"2020-03-31T15:07:46+02:00","containerized":false,"name":"webserver","ip":["127.0.0.1/8","::1/128","192.168.1.25/24","2003:c6:2f10:b900:215:5dff:fe01:501/64","fe80::215:5dff:fe01:501/64"],"kernel\_version":"5.3.0-45-generic","mac":["00:15:5d:01:05:01"],"os":{"family":"debian","platform":"ubuntu","name":"Ubuntu","version":"18.04.4 LTS (Bionic Beaver)","major":18,"minor":4,"patch":4,"codename":"bionic"},"timezone":"CEST","timezone\_offset\_sec":7200,"id":"1655dd9026684064ac0fcd75d4ee6bb5"}}}  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.223+0200#011INFO#011[beat]#011instance/beat.go:1003#011Process info#011{"system\_info": {"process": {"capabilities": {"inheritable":null,"permitted":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"effective":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"bounding":["chown","dac\_override","dac\_read\_search","fowner","fsetid","kill","setgid","setuid","setpcap","linux\_immutable","net\_bind\_service","net\_broadcast","net\_admin","net\_raw","ipc\_lock","ipc\_owner","sys\_module","sys\_rawio","sys\_chroot","sys\_ptrace","sys\_pacct","sys\_admin","sys\_boot","sys\_nice","sys\_resource","sys\_time","sys\_tty\_config","mknod","lease","audit\_write","audit\_control","setfcap","mac\_override","mac\_admin","syslog","wake\_alarm","block\_suspend","audit\_read"],"ambient":null}, "cwd": "/", "exe": "/usr/share/filebeat/bin/filebeat", "name": "filebeat", "pid": 98144, "ppid": 1, "seccomp": {"mode":"filter","no\_new\_privs":true}, "start\_time": "2020-05-11T07:41:25.630+0200"}}}  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.223+0200#011INFO#011instance/beat.go:298#011Setup Beat: filebeat; Version: 7.6.2  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.224+0200#011DEBUG#011[beat]#011instance/beat.go:324#011Initializing output plugins  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.226+0200#011DEBUG#011[publisher]#011pipeline/consumer.go:137#011start pipeline event consumer  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.226+0200#011INFO#011[publisher]#011pipeline/module.go:110#011Beat name: webserver  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.226+0200#011INFO#011instance/beat.go:412#011filebeat stopped.  
May 11 07:41:26 webserver filebeat[98144]: 2020-05-11T07:41:26.226+0200#011ERROR#011instance/beat.go:933#011Exiting: Fileset apache/var is configured but doesn't exist  
May 11 07:41:26 webserver filebeat[98144]: Exiting: Fileset apache/var is configured but doesn't exist  
May 11 07:41:26 webserver systemd[1]: filebeat.service: Main process exited, code=exited, status=1/FAILURE  
May 11 07:41:26 webserver systemd[1]: filebeat.service: Failed with result 'exit-code'.  
May 11 07:41:26 webserver systemd[1]: filebeat.service: Service hold-off time over, scheduling restart.  
May 11 07:41:26 webserver systemd[1]: filebeat.service: Scheduled restart job, restart counter is at 5.  
May 11 07:41:26 webserver systemd[1]: Stopped Filebeat sends log files to Logstash or directly to Elasticsearch..  
May 11 07:41:26 webserver systemd[1]: filebeat.service: Start request repeated too quickly.  
May 11 07:41:26 webserver systemd[1]: filebeat.service: Failed with result 'exit-code'.  
May 11 07:41:26 webserver systemd[1]: Failed to start Filebeat sends log files to Logstash or directly to Elasticsearch..'

Thanks  
René

---

<div class="post-metadata">

**Author:** ![Hausmeister](https://avatars.discourse-cdn.com/v4/letter/h/f05b48/32.png) [@Hausmeister](https://discuss.elastic.co/u/Hausmeister)\
**Post date:** [May 11, 2020, 5:48am UTC](https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725/4 "2020-05-11T05:48:11Z")

</div>

All,

found the issue.  
There were some tabs missing before "enabled" and "var.paths".  
Now it's working.  
Thanks @jsoriano

Cheers  
René

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 8, 2020, 5:48am UTC](https://discuss.elastic.co/t/apache-module-and-var-paths-not-working/231725/5 "2020-06-08T05:48:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.