# Filebeat PANW module

**URL:** <https://discuss.elastic.co/t/filebeat-panw-module/317357>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 25, 2022, 1:38am UTC](https://discuss.elastic.co/t/filebeat-panw-module/317357 "2022-10-25T01:38:04Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gunlomboy](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\
**Post date:** [October 25, 2022, 1:38am UTC](https://discuss.elastic.co/t/filebeat-panw-module/317357/1 "2022-10-25T01:38:04Z")

</div>

Hi,

Can anyone point me in the right direction getting the panw module to work. We are running filebeat 8.4 but everything I try results in:

**Exiting: module panw is configured but has no enabled filesets**

panw module is configured as follows:

```auto
# Module: panw
# Docs: https://www.elastic.co/guide/en/beats/filebeat/main/filebeat-module-panw.html

- module: panw
  panos:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: file

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/panw.log"]

```

Is there a step I'm missing?

Thanks.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [October 25, 2022, 6:02pm UTC](https://discuss.elastic.co/t/filebeat-panw-module/317357/2 "2022-10-25T18:02:40Z")

</div>

How do you receive data, by syslog or you read a log file?

Have you setup dashboards? Do you have the same fields as in [the specification](https://www.elastic.co/guide/en/beats/filebeat/current/exported-fields-panw.html)?

---

<div class="post-metadata">

**Author:** ![gunlomboy](https://avatars.discourse-cdn.com/v4/letter/g/c0e974/32.png) [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\
**Post date:** [October 27, 2022, 3:25am UTC](https://discuss.elastic.co/t/filebeat-panw-module/317357/3 "2022-10-27T03:25:08Z")

</div>

Thanks @Rios

It was a combination of:

- The ingest pipelines failing to install in elasticsearch

- Permissions on the log files

Thanks for your help.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 24, 2022, 5:25am UTC](https://discuss.elastic.co/t/filebeat-panw-module/317357/4 "2022-11-24T05:25:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.