Doubt about System Module [Filebeat]

[RdrgPorto (Rodrigo Porto)]

Hi, everyone

I would like to know over which logs Module System is able to parse.

In Filebeat Doc, it shows an example with auth.log and syslog. Is it possible to do it with logs as secure, messages, etc?

From my point of view, it would be better to mention which kind of logs can be used with this module.

Thanks in advance,

Rodrigo

[mtojek (Marcin Tojek)]

You can configure filebeat to collect and process all possible log files. In this case, you may need to provide your custom processing pipeline.

[RdrgPorto (Rodrigo Porto)]

Hi, @mtojek

My doubt is which logs Module Sytem is able to parse ? only auth.log and syslog ?

Thanks in advance,

Regards

[mtojek (Marcin Tojek)]

Correct. See: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html