# Filebeat - Dashboard system not working **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 19, 2018, 7:16am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434 "2018-06-19T07:16:14Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 7:16am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/1 "2018-06-19T07:16:14Z")
Hello, Elasticsearch Version 6.2.4 Filebeat Client 6.3.0 - I send logs from filebeat's client under Centos 7 with output to Elasticsearch. - I setup the 3 node cluster with geoip, user-agent plugin and reboot each node Two path in filebeat.yml was configured - /var/log/secure - /var/log/messages Module system is enabled on the client with command : filebeat modules list INFO log/harvester.go:228 Harvester started for file: /var/log/secure INFO log/harvester.go:228 Harvester started for file: /var/log/messages Kibana display my log in discover's page, but in dashboard's page system nothing ... Could you help me ? Thank for answer David ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 8:05am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/2 "2018-06-19T08:05:46Z")
So i disable module with cmd line : filebeat modules disable system To re-enable in config file : - module: system # Syslog syslog: enabled: true auth: enabled: true i remove all line for : filebeat.inputs. Now i have only monitoring INFO. but nothing other in my filebeat.log INFO instance/beat.go:607 Kibana dashboards successfully loaded. INFO instance/beat.go:315 filebeat start running. INFO registrar/registrar.go:112 Loading registrar data from /var/lib/filebeat/registry INFO registrar/registrar.go:123 States Loaded from registrar: 18 INFO crawler/crawler.go:48 Loading Inputs: 2 INFO log/input.go:111 Configured paths: [/var/log/auth.log\* /var/log/secure\*] INFO input/input.go:87 Starting input of type: log; ID: 601603990474112990 INFO log/harvester.go:228 Harvester started for file: /var/log/secure INFO log/input.go:111 Configured paths: [/var/log/messages\* /var/log/syslog\*] INFO input/input.go:87 Starting input of type: log; ID: 11041985141352213301 INFO crawler/crawler.go:82 Loading and starting Inputs completed. Enabled inputs: 2 INFO cfgfile/reload.go:122 Config reloader started INFO cfgfile/reload.go:214 Loading of config files completed. INFO log/harvester.go:228 Harvester started for file: /var/log/messages INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.2.4 INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.2.4 INFO template/load.go:73 Template already exists and will not be overwritten. INFO elasticsearch/client.go:690 Connected to Elasticsearch version 6.2.4 INFO template/load.go:73 Template already exists and will not be overwritten. INFO template/load.go:73 Template already exists and will not be overwritten. if during 5 minutes no change on /var/log/secure and messages. filebeat.log give me : File is inactive: /var/log/secure. Closing because close\_inactive of 5m0s reached. File is inactive: /var/log/messages. Closing because close\_inactive of 5m0s reached. if i try a bad ssh login -\> Harvester started for file: /var/log/messages Harvester started for file: /var/log/secure I cant see what i missed ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [June 19, 2018, 9:10am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/3 "2018-06-19T09:10:36Z")
HI, Please enable below configuration in filebeat.yml file if you enable the module in config file. ``` #============================== Dashboards ===================================== # These settings control loading the sample dashboards to the Kibana index. Loading # the dashboards is disabled by default and can be enabled either by setting the # options here, or by using the `-setup` CLI flag. dashboards.enabled: true ``` It will enable the all default dashboards in kibana. Please share debug level log of filebeat if you still face any issue in this regards. Regards, ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 9:16am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/4 "2018-06-19T09:16:21Z")
Thx for reply I already have the default dashboard and this value to true in my YML. With Centos 7 i successfully have syslog dashboard working but for ssh login dashboard dont work with Centos 7. I see in Visualize-\> SSH login attempts [Filebeat System] the name system.auth.ssh.event. But nothing from my log is indexed with this value. I have my ssh login in this value : system.syslog.hostname system.syslog.program system.syslog.message If i put in module auth logs a custom path : /var/log/secure i have this error -\> Exiting: Error getting config for fileset system/auth: Error interpreting the template of the input: template: text:3:22: executing "text" at \<.paths\> I think the problem is here ... maybe template cannot interprete a centos SSH log. ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [June 19, 2018, 9:25am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/5 "2018-06-19T09:25:08Z")
Ohk i understood, could you please share the a sample log and also share the kibana o/p with logs like below. ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/4/14c952c5bf7fb256a58336add7881d286dbd4af0.png) > [@](#): > > maybe template cannot interprete a centos SSH log. Yes that's what i want to know that template is parsing properly or not and same you can in kibana discover page for a particular log and after that we can identify the issue. Please share so that we can identify. Regads, ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 9:35am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/6 "2018-06-19T09:35:57Z")
Here the result of a SSH Login Failed. Source from /var/log/secure but put in syslog. I dont have an auht.log in Centos 7. ![ssh_login](https://us1.discourse-cdn.com/elastic/original/3X/6/1/61368b46c73c066e456853b20a72b4b95871eac9.png) ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 9:53am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/7 "2018-06-19T09:53:45Z")
when i put in auth module custom path like that : var.paths: ["/var/log/secure"] it was good !!! it take time analyse index filebeat\* and now my dashboard ssh login works thx for support ---
**Author:** ![harshbajaj16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/harshbajaj16/32/44970_2.png) [@harshbajaj16](https://discuss.elastic.co/u/harshbajaj16)\ **Post date:** [June 19, 2018, 9:53am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/8 "2018-06-19T09:53:53Z")
it seems ok your fields are parsing properly. Have you changed the time in kibana like "This week", "Last 15 minutes" etc. Select "This Week" or "Month" an try. ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/006867d3f43885c37133555459e99454d4956d11.png) your kibana logs are ok it should be visible in dashboard. Regards, ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 9:55am UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/9 "2018-06-19T09:55:35Z")
it's ok Thx ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 12:53pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/10 "2018-06-19T12:53:15Z")
in fact i have +2 hours in my @timestamp log for SSH Login dahsboard. @timestamp June 19th 2018, 14:07:20.000 t system.auth.timestamp Jun 19 12:07:20 My 3 node ELK have : Tue Jun 19 14:48:12 CEST 2018 My Beat CLient : Tue Jun 19 14:48:18 CEST 2018 How to force time or timezone to collect log at the same time ? thx ---
**Author:** ![dpachot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpachot/32/109307_2.png) [@dpachot](https://discuss.elastic.co/u/dpachot)\ **Post date:** [June 19, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/11 "2018-06-19T13:47:35Z")
ok i change the timezone in file pipeline.json. and delete curl -XDELETE [http://elasticsearch:9200/\_ingest/pipeline/filebeat-\*](http://elasticsearch:9200/_ingest/pipeline/filebeat-*) it's ok now ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 17, 2018, 1:47pm UTC](https://discuss.elastic.co/t/filebeat-dashboard-system-not-working/136434/12 "2018-07-17T13:47:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.