# Elasticsearch not processing log lines?

**URL:** <https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 17, 2018, 12:08am UTC](https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265 "2018-04-17T00:08:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![exwizzard](https://avatars.discourse-cdn.com/v4/letter/e/c67d28/32.png) [@exwizzard](https://discuss.elastic.co/u/exwizzard)\
**Post date:** [April 17, 2018, 12:08am UTC](https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265/1 "2018-04-17T00:08:16Z")

</div>

I have filebeat version 6.2.3 and I have configured the output to elasticsearch and set the default prospector to "enabled: true".  
I have enabled the system module, when I go to discover tab I only see the default fields, there are no system fields. Is the default prospector somehow messing with the system module? I am using default settings for everything.

Screenshot:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5eafc386340953acdc2cdb3de51b874a417cb0e7.png)

---

<div class="post-metadata">

**Author:** ![exwizzard](https://avatars.discourse-cdn.com/v4/letter/e/c67d28/32.png) [@exwizzard](https://discuss.elastic.co/u/exwizzard)\
**Post date:** [April 17, 2018, 1:04am UTC](https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265/2 "2018-04-17T01:04:06Z")

</div>

I have changed the default prospector log line to point to some other log file and now I am not getting any logs into my elasticsearch from the system module. The filebeat log says:

```
 2018-04-16T21:01:37.765-0400 INFO log/prospector.go:111 Configured paths: [/var/log/auth.log* /var/log/secure*]
2018-04-16T21:01:37.765-0400 INFO log/prospector.go:111 Configured paths: [/var/log/messages* /var/log/syslog*]
2018-04-16T21:01:37.765-0400 INFO cfgfile/reload.go:258 Starting 1 runners ...
2018-04-16T21:01:37.766-0400 INFO elasticsearch/client.go:145 Elasticsearch url: https://xx:9200
2018-04-16T21:01:37.774-0400 INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.2.3
2018-04-16T21:01:37.778-0400 INFO log/harvester.go:216 Harvester started for file: /var/log/auth.log
2018-04-16T21:01:37.778-0400 INFO log/harvester.go:216 Harvester started for file: /var/log/syslog

```

But nothing appears in the filebeat index except for the random log I put into filebeat.yml file.

---

<div class="post-metadata">

**Author:** ![exwizzard](https://avatars.discourse-cdn.com/v4/letter/e/c67d28/32.png) [@exwizzard](https://discuss.elastic.co/u/exwizzard)\
**Post date:** [April 17, 2018, 1:44am UTC](https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265/3 "2018-04-17T01:44:46Z")

</div>

Its working fine when I enable the apache2 module, so I am guessing the system module does not support ubuntu 16.04 maybe?

---

<div class="post-metadata">

**Author:** ![exwizzard](https://avatars.discourse-cdn.com/v4/letter/e/c67d28/32.png) [@exwizzard](https://discuss.elastic.co/u/exwizzard)\
**Post date:** [April 17, 2018, 9:56pm UTC](https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265/4 "2018-04-17T21:56:39Z")

</div>

The data started coming in after a while, I think it records data every 30 minutes or something like that.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 15, 2018, 9:56pm UTC](https://discuss.elastic.co/t/elasticsearch-not-processing-log-lines/128265/5 "2018-05-15T21:56:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.