# Filebeat - issue after enable elasticsearch module **URL:** \ **Category:** Beats\ **Tags:** beats-module, filebeat\ **Created:** [February 17, 2022, 11:06pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553 "2022-02-17T23:06:14Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![dominbdg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dominbdg/32/102457_2.png) [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Post date:** [February 17, 2022, 11:06pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553/1 "2022-02-17T23:06:14Z")
Hello, I would like to filebeat process my Elasticsearch audit logs. When I enable Elasticsearch module (filebeat modules enable Elasticsearch) module is enabled and under modules.d file Elasticsearch.yml.disabled changed to Elasticsearch.yml my Elasticsearch.yml looks like below: ```auto # Module: elasticsearch # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-elasticsearch.html - module: elasticsearch # Server log server: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: gc: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: audit: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. var.paths: /opt/local-cluster_audit.json slowlog: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: deprecation: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: ``` When module is enabled and I going to restart filebeat, after restart I'm receiving error: ```auto ERROR instance/beat.go:1015 Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error getting config for fileset elasticsearch/audit: Error interpreting the template of the input: template: text:3:22: executing "text" at <.paths>: range can't iterate over /opt/pci-cluster_audit.json > Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error getting config for fileset elasticsearch/audit: Error interpreting the template of the input: template: text:3:22: executing "text" at <.paths>: range can't iterate over /opt/pci-cluster_audit.json ``` ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [February 20, 2022, 2:10am UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553/2 "2022-02-20T02:10:54Z")
`vat.paths` should be a list. ---
**Author:** ![dominbdg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dominbdg/32/102457_2.png) [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Post date:** [February 20, 2022, 11:04am UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553/3 "2022-02-20T11:04:13Z")
I have enabled var.paths. Below is my config for Elasticsearch module: ```auto # Module: elasticsearch # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-elasticsearch.html - module: elasticsearch # Server log server: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: gc: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: audit: enabled: true # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. var.paths: /opt/aaa-cluster_audit.json slowlog: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: deprecation: enabled: false # Set custom paths for the log files. If left empty, # Filebeat will choose the paths depending on your OS. #var.paths: ``` ---
**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\ **Post date:** [February 20, 2022, 3:43pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553/4 "2022-02-20T15:43:51Z")
Yes but you've set `var.paths` as a string, u need to make it a list like below. ```auto var.paths: - /xxxxx/xxxxx..... ``` ---
**Author:** ![dominbdg](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dominbdg/32/102457_2.png) [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Post date:** [February 20, 2022, 8:03pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553/5 "2022-02-20T20:03:16Z")
Hello, Alex many thanks for Your help, to be honest I'm working on that couple of days and didn't understand what's going on, I thought that Elasticsearch module - it is regular config and it looks like this is yaml config. You helped me a lot! Thanks for that ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 20, 2022, 10:03pm UTC](https://discuss.elastic.co/t/filebeat-issue-after-enable-elasticsearch-module/297553/6 "2022-03-20T22:03:24Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.