# Auth logs not parsed in filebeat 5.4.0
**URL:** https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707
**Category:** Beats
**Tags:** filebeat
**Created:** [May 5, 2017, 11:40am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707 "2017-05-05T11:40:05Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@nbrys](https://discuss.elastic.co/u/nbrys)
#### Post date: [May 5, 2017, 11:40am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/1 "2017-05-05T11:40:05Z")
On my elk server (ubuntu) and source host (ubuntu) i've upgraded the filebeat module to 5.4.0. I send my logs using filebeat to the elasticsearch service (not to logstash). The logs from /var/log/auth.log are inserted in elasticsearch correctly, but they aren't parsed. I just stays 1 json:
> **[Screen Shot 2017 05 05 at 13 36 01](https://ibb.co/jdhD5k)**
>
> Image Screen Shot 2017 05 05 at 13 36 01 hosted in imgbb.com
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 9, 2017, 7:35am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/2 "2017-05-09T07:35:57Z")
Can you share your config file and the command you used to start filebeat?
---
### Author:  [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)
#### Post date: [May 14, 2017, 5:43pm UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/3 "2017-05-14T17:43:27Z")
i have the same issue @ruflin
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 15, 2017, 9:19am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/4 "2017-05-15T09:19:28Z")
@Me_Cloud Could you share your config file and the command you used to start filebeat? Also an excerpt of your auth log would be great.
---
### Author:  [@Me\_Cloud](https://discuss.elastic.co/u/Me_Cloud)
#### Post date: [May 20, 2017, 8:50am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/5 "2017-05-20T08:50:58Z")
here my config file @ruflin
filebeat.yml
> - input\_type: log
> # Paths that should be crawled and fetched. Glob based paths.
>
> paths:
> - /var/log/messages
> document\_type: syslog
> #- c:\programdata\elasticsearch\logs\*
> - input\_type: log
> # Paths that should be crawled and fetched. Glob based paths.
>
> paths:
> - /var/log/secure
> document\_type: sshlog
> #- c:\programdata\elasticsearch\logs\*
logstash input
> input {
> beats {
> port =\> 5044
> ssl =\> true
> ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"
> ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"
> }
> }
filter
> filter {
> if [type] == "syslog" {
> grok {
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:$
> add\_field =\> ["received\_at", "%{@timestamp}"]
> add\_field =\> ["received\_from", "%{host}"]
> }
> syslog\_pri { }
> date {
> match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
> }
> }
> if [type] == "sshlog" {
> grok {
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_date} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}(?:[%{POSINT}])?: %{WORD:login} password for %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}" }
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_date} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}(?:[%{POSINT}])?: "message", "%{SYSLOGTIMESTAMP:syslog\_date} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}(?:[%{POSINT}])?: message repeated 2 times: [ %{WORD:login} password for %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}" }
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_date} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}(?:[%{POSINT}])?: %{WORD:login} password for invalid user %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}" }
> match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_date} %{SYSLOGHOST:syslog\_host} %{DATA:syslog\_program}(?:[%{POSINT}])?: %{WORD:login} %{WORD:auth\_method} for %{USERNAME:username} from %{IP:ip} %{GREEDYDATA}" }
> }
> date {
> match =\> ["syslog\_date", "MMM d HH:mm:ss", "MMM dd HH:mm:ss", "ISO8601"]
> timezone =\> "Asia/Jakarta"
> }
> geoip {
> source =\> "ip"
> }
> }
> }
output
> output {
> elasticsearch {
> hosts =\> ["localhost:9200"]
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> document\_type =\> "%{[@metadata][type]}"
> }
> }
is there any wrong config in my filebeat.yml? because if i don't use document\_type in filebeat.yml it can parsed the log and i can see the log in kibana, but if i use document\_type it can't parsed and i can't see the log in kibana.
but in filebeat log there is a log
> INFO Non-zero metrics in the last 30s: libbeat.logstash.call\_count.PublishEvents=3 libbeat.logstash.publish.read\_bytes=105 libbeat.logstash.
---
### Author:  [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [June 6, 2017, 8:35am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/6 "2017-06-06T08:35:51Z")
@Me_Cloud please create another topic. Your issue/configuration is not related to original discussion.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2017, 8:35am UTC](https://discuss.elastic.co/t/auth-logs-not-parsed-in-filebeat-5-4-0/84707/7 "2017-07-04T08:35:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.