# Filebeat module system don't parse auth log

**URL:** <https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 12, 2021, 11:40am UTC](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801 "2021-05-12T11:40:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![beci](https://avatars.discourse-cdn.com/v4/letter/b/ac8455/32.png) [@beci](https://discuss.elastic.co/u/beci)\
**Post date:** [May 12, 2021, 11:40am UTC](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801/1 "2021-05-12T11:40:33Z")

</div>

Hello all,

I am using Filebeat 7.12.1 with the system module  
The logs send in Elastic without problem, but some failed authentication logs from pam\_unix(sshd:auth) are not parsed.  
Do you know why?

 ![Elastic_filebeat_system_auth](https://us1.discourse-cdn.com/elastic/original/3X/7/c/7c46df81e13f7f873543191f8bbab07361c0340c.png)

Thank you very much !  
Guillaume

---

<div class="post-metadata">

**Author:** ![beci](https://avatars.discourse-cdn.com/v4/letter/b/ac8455/32.png) [@beci](https://discuss.elastic.co/u/beci)\
**Post date:** [June 1, 2021, 10:04am UTC](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801/2 "2021-06-01T10:04:50Z")

</div>

Nobody has any ideas ? ☹

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 29, 2021, 12:05pm UTC](https://discuss.elastic.co/t/filebeat-module-system-dont-parse-auth-log/272801/3 "2021-06-29T12:05:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.