Filebeat PANW module


Can anyone point me in the right direction getting the panw module to work. We are running filebeat 8.4 but everything I try results in:

Exiting: module panw is configured but has no enabled filesets

panw module is configured as follows:

# Module: panw
# Docs:

- module: panw
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: file

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/panw.log"]

Is there a step I'm missing?


How do you receive data, by syslog or you read a log file?

Have you setup dashboards? Do you have the same fields as in the specification?

Thanks @Rios

It was a combination of:

  • The ingest pipelines failing to install in elasticsearch

  • Permissions on the log files

Thanks for your help.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.