# Filebeat: ES not receiving index from filebeat

**URL:** <https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 31, 2018, 10:12am UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016 "2018-05-31T10:12:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jemueldalino](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemueldalino/32/31780_2.png) [@jemueldalino](https://discuss.elastic.co/u/jemueldalino)\
**Post date:** [May 31, 2018, 10:12am UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016/1 "2018-05-31T10:12:00Z")

</div>

I'm trying to explore the security recipe for suspicious login activity in my local machine  
[https://github.com/elastic/examples/blob/master/Machine%20Learning/Security%20Analytics%20Recipes/suspicious\_login\_activity/configs/filebeat/filebeat.yml](https://github.com/elastic/examples/blob/master/Machine%20Learning/Security%20Analytics%20Recipes/suspicious_login_activity/configs/filebeat/filebeat.yml)

When trying to index the auth.log, nothing appears in the create index pattern of kibana.

Here's my filebeat.yml

filebeat.modules:

- module: system  
syslog:  
enabled: false  
auth:  
enabled: true  
var.paths: ["/data/auth.log"]  
name: test  
output.elasticsearch:  
hosts: ["[http://elastic-url:9200](http://elastic-url:9200)"]  
username: "elastic"  
password: "secret"  
setup.kibana:  
host: "[http://kibana-url:5601](http://kibana-url:5601)"  
username: "elastic"  
password: "secret"  
logging.level: debug  
logging.selectors: ["publish"]  
setup.dashboards.enabled: true

Am I missing something?

---

<div class="post-metadata">

**Author:** ![exekias](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/exekias/32/28718_2.png) [@exekias](https://discuss.elastic.co/u/exekias)\
**Post date:** [May 31, 2018, 10:33am UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016/2 "2018-05-31T10:33:29Z")

</div>

Hi @jemueldalino,

Did you run `filebeat setup` command? It should configure kibana and deploy some dashboards for you.

Best regards

---

<div class="post-metadata">

**Author:** ![jemueldalino](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemueldalino/32/31780_2.png) [@jemueldalino](https://discuss.elastic.co/u/jemueldalino)\
**Post date:** [May 31, 2018, 12:06pm UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016/3 "2018-05-31T12:06:09Z")

</div>

I just ran filebeat via docker run using the .yml earlier. The dashboards were created but theres no data. When checking index patterns, there's indices. Is my var.path wrong?

---

<div class="post-metadata">

**Author:** ![vishnuduttpv](https://avatars.discourse-cdn.com/v4/letter/v/5daacb/32.png) [@vishnuduttpv](https://discuss.elastic.co/u/vishnuduttpv)\
**Post date:** [May 31, 2018, 12:26pm UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016/4 "2018-05-31T12:26:14Z")

</div>

Hi,  
Whats the OS platform?

For Debian systems the logins will be stored in /var/log/auth.log  
For Redhat Systems I think the file is /var/log/secure.  
The auth logs vary. Whether the /data/auth.log is having data?  
Does any other logs are available in ES from filebeat?  
ES requires two plugin installation for the proper working of Filebeat.

Vishnu

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2018, 12:39pm UTC](https://discuss.elastic.co/t/filebeat-es-not-receiving-index-from-filebeat/134016/5 "2018-06-28T12:39:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.