# Filebeat 8.3.2 module and file stream issues

**URL:** <https://discuss.elastic.co/t/filebeat-8-3-2-module-and-file-stream-issues/310192>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 20, 2022, 6:44pm UTC](https://discuss.elastic.co/t/filebeat-8-3-2-module-and-file-stream-issues/310192 "2022-07-20T18:44:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![CynorSense](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cynorsense/32/108469_2.png) [@CynorSense](https://discuss.elastic.co/u/CynorSense)\
**Post date:** [July 20, 2022, 6:44pm UTC](https://discuss.elastic.co/t/filebeat-8-3-2-module-and-file-stream-issues/310192/1 "2022-07-20T18:44:52Z")

</div>

Modules in filebeat 8.3.2 had changed the file input to filestream and indexing is happening through filestream.

When we enable modules. It is not working at all.

We tried to enable manually using  
filebeat setup --pipelines --dashboards --index-management --modules cef -M "cef.log.enable=true" -M "cef.log.var.input=file" -M "cef.log.var.paths=["/Syslog/_/_/_/_.forcepointlog"]"

It did configure the module but still throughs error that cef doesn't have fileset configured.

I have also configured cef module as in below

# Module: cef

# Docs: [CEF module | Filebeat Reference [8.3] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/8.3/filebeat-module-cef.html)

- module: cef  
log:  
enabled: true  
var:  
input: file  
path: /Syslog/_/_/_/_.forcepointlog

Filebeat configuration is as below

# ============================== Filebeat inputs ===============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so

# you can use different inputs for various configurations.

# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.

- type: filestream

# ============================== Filebeat modules ==============================

filebeat.config.modules:

# Glob pattern for configuration loading

path: ${path.config}/modules.d/_.yml  
 #path: /etc/filebeat/modules.d/_.yml

# Set to true to enable config reloading

reload.enabled: true

# Period on which files under path should be checked for changes

reload.period: 10s

.  
.  
.

# ---------------------------- Elasticsearch Output ----------------------------

output.elasticsearch:

# Array of hosts to connect to.

hosts: ["node1:9200","node2:9200","node3:9200"]

# Protocol - either `http` (default) or `https`.

protocol: "https"

# Authentication credentials - either API key or username/password.

#api\_key: "id:api\_key"  
username: "elastic"  
password: "password"  
ssl.certificate\_authorities: ["/etc/filebeat/certs/ca.pem"]

Any help with this latest issue please?

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [July 21, 2022, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-8-3-2-module-and-file-stream-issues/310192/2 "2022-07-21T12:55:58Z")

</div>

Hi, could you please format your post first using `code tags`?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 18, 2022, 2:56pm UTC](https://discuss.elastic.co/t/filebeat-8-3-2-module-and-file-stream-issues/310192/3 "2022-08-18T14:56:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.