# Auditd module | No results found

**URL:** <https://discuss.elastic.co/t/auditd-module-no-results-found/112315>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [December 18, 2017, 9:50pm UTC](https://discuss.elastic.co/t/auditd-module-no-results-found/112315 "2017-12-18T21:50:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![alexus](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/alexus/32/12696_2.png) [@alexus](https://discuss.elastic.co/u/alexus)\
**Post date:** [December 18, 2017, 9:50pm UTC](https://discuss.elastic.co/t/auditd-module-no-results-found/112315/1 "2017-12-18T21:50:51Z")

</div>

I'm trying to utilize [Auditd module | Filebeat Reference [6.1] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-auditd.html).

My Elastic Stack environment:

```
# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 7.4 (Maipo)
# rpm -q filebeat elasticsearch
filebeat-6.1.0-1.x86_64
elasticsearch-6.1.0-1.noarch
# 

```

I'm trying to open ` [Filebeat Auditd] Audit Events` dashboard and I see

> No results found

My configuration:

```
# filebeat modules list
Enabled:
auditd
system

Disabled:
apache2
auditd
icinga
kafka
logstash
mysql
nginx
postgresql
redis
system
traefik
# cat /etc/filebeat/modules.d/auditd.yml
- module: auditd
  log:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/audit/audit.log*"]
# file /var/log/audit/audit.log*
/var/log/audit/audit.log: ASCII text
/var/log/audit/audit.log.1: ASCII text, with very long lines
/var/log/audit/audit.log.2: ASCII text
/var/log/audit/audit.log.3: ASCII text
/var/log/audit/audit.log.4: ASCII text
# filebeat test config
Config OK
# filebeat test output
elasticsearch: http://X:9200...
  parse url... OK
  connection...
    parse host... OK
    dns lookup... OK
    addresses: X.X.X.X
    dial up... OK
  TLS... WARN secure connection disabled
  talk to server... OK
  version: 6.1.0
# 

```

after switching `logging.level` to `debug`, I can see filebeat is publishing events, yet when I check via Kibana I don't see any...

and now and than I see following `WARN`:

```
2017-12-19T10:50:01-05:00 DBG [elasticsearch] PublishEvents: 1 events have been published to elasticsearch in 6.884453ms.
2017-12-19T10:50:01-05:00 WARN Can not index event (status=400): {"type":"mapper_parsing_exception","reason":"Failed to parse mapping [doc]: Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]","caused_by":{"type":"mapper_parsing_exception","reason":"Mapping definition for [error] has unsupported parameters: [properties : {code={type=long}, message={norms=false, type=text}, type={ignore_above=1024, type=keyword}}]"}}
2017-12-19T10:50:01-05:00 DBG [memqueue] ackloop: receive ack [81: 0, 1]
2017-12-19T10:50:01-05:00 DBG [memqueue] broker ACK events: count=1, start-seq=107, end-seq=107

2017-12-19T10:50:01-05:00 DBG [memqueue] ackloop: return ack to broker loop:1
2017-12-19T10:50:01-05:00 DBG [memqueue] ackloop: done send ack

```

Please advise

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [December 20, 2017, 12:50am UTC](https://discuss.elastic.co/t/auditd-module-no-results-found/112315/2 "2017-12-20T00:50:41Z")

</div>

It looks like there is a conflict in the index template. I assume you used Metricbeat 5 and upgraded to 6 but changed the index name and template generation? Can you share your ES output configs?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 17, 2018, 12:51am UTC](https://discuss.elastic.co/t/auditd-module-no-results-found/112315/3 "2018-01-17T00:51:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.