# Filebeat Barracuda module

**URL:** <https://discuss.elastic.co/t/filebeat-barracuda-module/300008>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [March 18, 2022, 6:36am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008 "2022-03-18T06:36:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![janis.cimins](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\
**Post date:** [March 18, 2022, 6:36am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008/1 "2022-03-18T06:36:35Z")

</div>

Hello!  
I have a problem with ingest barracuda logs. But I have trouble on setting up barracuda module. It gives me this error when I enable module and run "sudo filebeat setup -e"

2022-03-15T15:32:39.986Z ERROR instance/beat.go:1015 Exiting: 1 error: error loading config file: invalid config: yaml: line 8: did not find expected key  
Exiting: 1 error: error loading config file: invalid config: yaml: line 8: did not find expected key

Does any one know what is this the right configuration what I need to put in place to get them running? When I leave the default configuration it does not give me an error, but when I uncomment line then it gives me this error.

I have these firewall rules in place:siem@siem:/etc/filebeat$ sudo ufw status verbose  
Status: active  
Logging: on (low)  
Default: deny (incoming), allow (outgoing), disabled (routed)  
New profiles: skip

To Action From

* * *

22/tcp ALLOW IN Anywhere  
9503/tcp ALLOW IN Anywhere  
5601/tcp ALLOW IN Anywhere  
514/tcp ALLOW IN Anywhere  
514/udp ALLOW IN Anywhere  
8220/tcp ALLOW IN Anywhere  
8220/udp DENY IN Anywhere  
9503/udp ALLOW IN Anywhere  
9524/tcp ALLOW IN Anywhere  
9524/udp ALLOW IN Anywhere  
8220/tcp (v6) ALLOW IN Anywhere (v6)  
8220/udp (v6) DENY IN Anywhere (v6)  
9503/udp (v6) ALLOW IN Anywhere (v6)  
9524/tcp (v6) ALLOW IN Anywhere (v6)  
9524/udp (v6) ALLOW IN Anywhere (v6)

I have no idea why is this not working. Please guide me where to look because I can not find resource how to deal with this problem.

---

<div class="post-metadata">

**Author:** ![mtojek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mtojek/32/63863_2.png) [@mtojek](https://discuss.elastic.co/u/mtojek)\
**Post date:** [March 21, 2022, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008/2 "2022-03-21T15:33:21Z")

</div>

Could you please post your configuration? Maybe we will spot the problem.

---

<div class="post-metadata">

**Author:** ![janis.cimins](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\
**Post date:** [March 22, 2022, 6:52am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008/3 "2022-03-22T06:52:14Z")

</div>

Yes. There was a problem that customer did not open 9200 port as well, but still no logs there.  
Here is the configuration of module that is enabled on SIEM system (maybe I need to install it on Barracuda server, but I`m not sure about that):

```auto
# Module: barracuda
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-barracuda.html

- module: barracuda
  waf:
    enabled: true

    # Set which input to use between udp (default), tcp or file.
    # var.input: udp
    # var.syslog_host: 0.0.0.0
    # var.syslog_port: 9503

    # Set paths for the log files when file input is used.
    # var.paths:

    # Toggle output of non-ECS fields (default true).
    # var.rsa_fields: true

    # Set custom timezone offset.
    # "local" (default) for system timezone.
    # "+02:00" for GMT+02:00
    # var.tz_offset: local

  spamfirewall:
    enabled: true

    # Set which input to use between udp (default), tcp or file.
    # var.input: udp
    # var.syslog_host: 0.0.0.0
    # var.syslog_port: 9524

    # Set paths for the log files when file input is used.
    # var.paths:

    # Toggle output of non-ECS fields (default true).
    # var.rsa_fields: true

    # Set custom timezone offset.
    # "local" (default) for system timezone.
    # "+02:00" for GMT+02:00
    # var.tz_offset: local

```

I believe it is the default configuration. When I uncomment lines then it gives me an error about some Key that was expected.

I have updated firewall configuration as this:

```auto
siem@siem:/etc/filebeat$ sudo ufw status numbered
[sudo] password for siem:
Status: active

     To Action From
     -- ------ ----
[1] 22/tcp ALLOW IN Anywhere
[2] 514 ALLOW IN Anywhere
[3] 9200 ALLOW IN Anywhere
[4] 5601 ALLOW IN Anywhere
[5] 9503 ALLOW IN Anywhere
[6] 9524 ALLOW IN Anywhere
[7] 8220 ALLOW IN Anywhere
[8] 2055 ALLOW IN Anywhere

siem@siem:/etc/filebeat$

```

Filebeat.yml configuration is default as well, beside the configuration for Kibana and Elasticsearch output:

```auto
# =================================== Kibana ===================================

# Starting with Beats version 6.0.0, the dashboards are loaded via the Kibana API.
# This requires a Kibana endpoint configuration.
setup.kibana:

  # Kibana Host
  # Scheme and port can be left out and will be set to the default (http and 5601)
  # In case you specify and additional path, the scheme is required: http://localhost:5601/path
  # IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
  host: "172.23.27.98:5601"

  # Kibana Space ID
  # ID of the Kibana Space into which the dashboards should be loaded. By default,
  # the Default Space will be used.
  #space.id:

# =============================== Elastic Cloud ================================

# These settings simplify using Filebeat with the Elastic Cloud (https://cloud.elastic.co/).

# The cloud.id setting overwrites the `output.elasticsearch.hosts` and
# `setup.kibana.host` options.
# You can find the `cloud.id` in the Elastic Cloud web UI.
#cloud.id:

# The cloud.auth setting overwrites the `output.elasticsearch.username` and
# `output.elasticsearch.password` settings. The format is `<user>:<pass>`.
#cloud.auth:

# ================================== Outputs ===================================

# Configure what output to use when sending the data collected by the beat.

# ---------------------------- Elasticsearch Output ----------------------------
output.elasticsearch:
  # Array of hosts to connect to.
  hosts: ["172.23.27.98:9200"]

  # Protocol - either `http` (default) or `https`.
  protocol: "http"

  # Authentication credentials - either API key or username/password.
  #api_key: "id:api_key"
  username: "elastic"
  password: "I4KmpGrNMhPcElDdbOBn"

```

I`m using Elastic version 7.17.1. and no SSL certificate. I hope that this is not the problem there as other modules work fine (for example Threatintel module).

---

<div class="post-metadata">

**Author:** ![janis.cimins](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\
**Post date:** [March 31, 2022, 8:57am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008/4 "2022-03-31T08:57:17Z")

</div>

Any suggestions? 🙂

---

<div class="post-metadata">

**Author:** ![janis.cimins](https://avatars.discourse-cdn.com/v4/letter/j/d2c977/32.png) [@janis.cimins](https://discuss.elastic.co/u/janis.cimins)\
**Post date:** [April 14, 2022, 6:34am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008/5 "2022-04-14T06:34:55Z")

</div>

Did you have a chance to spot it? 🙂 I guess there is not much to see though 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 12, 2022, 6:35am UTC](https://discuss.elastic.co/t/filebeat-barracuda-module/300008/6 "2022-05-12T06:35:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.