### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [November 16, 2020, 11:59am UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519/1 "2020-11-16T11:59:41Z")
I have to keep track of system logins with filebeat. Filebeat has a default dashboard called `[Filebeat System] SSH login attempts ECS` which seems perfect. So to use that, I went to one of the machines, stopped filebeat, ran `filebeat modules enable system`, and then started filebeat again.
The only problem is that I can't see the data in the dashboard, [it's empty](https://i.imgur.com/OP3sIZM.png), even though other data from that machine is visible in kibana. The flow is `remote-machine > logstash > ES < kibana`. If it matters, [this is my logstash config](https://pastebin.com/VK1gEKTz).
Does anyone happen to know why it's not showing up?
Thanks ahead.
EDIT: Found this in logstash log:
```
[2020-11-16T15:28:40,864][WARN][logstash.outputs.elasticsearch][main][273fbeeaf4d005660ef3730f09d3f76b92894ab8b1d7f2e60e9468d752981a3a] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"filebeat-7.9.0-2020.11.16", :routing=>nil, :_type=>"_doc", :pipeline=>"filebeat-7.9.0-system-auth-pipeline"}, #], :response=>{"index"=>{"_index"=>"filebeat-7.9.0-2020.11.16", "_type"=>"_doc", "_id"=>nil, "status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"pipeline with id [filebeat-7.9.0-system-auth-pipeline] does not exist"}}}}
```
---
### Author:  [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [November 16, 2020, 12:12pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519/2 "2020-11-16T12:12:17Z")
Hi,
What is your machine OS? because the system module is not supported on windows. accourding to [filebeat docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-system.html#_compatibility_34):
> This module is not available for Windows.
---
### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [November 16, 2020, 12:12pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519/3 "2020-11-16T12:12:58Z")
Thanks for the response,
It's CentOS 7
---
### Author:  [@borna\_talebi](https://discuss.elastic.co/u/borna_talebi)
#### Post date: [November 16, 2020, 12:18pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519/4 "2020-11-16T12:18:34Z")
> [@headtea](#):
>
> It's CentOS 7
So why don't you use auditbeat? I'm not sure but I think it supports system logins.
There's also [auditd module](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-auditd.html) for filebeat.
---
### Author:  [@headtea](https://discuss.elastic.co/u/headtea)
#### Post date: [November 16, 2020, 12:21pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519/5 "2020-11-16T12:21:16Z")
Thanks for the response.
I'm testing it now on a CentOS 7 machine, if I get that to work, I'll test on a CentOS 5 machine which can only run filebeat (auditbeat is not working on CentOS 5). I'm just not quite sure what to enable with auditd to see the same data.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2020, 3:14pm UTC](https://discuss.elastic.co/t/filebeat-module-to-see-system-logins/255519/7 "2020-12-14T15:14:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.