# Filebeat: secure/messages for centos **URL:** \ **Category:** Beats\ **Created:** [March 19, 2018, 7:40am UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496 "2018-03-19T07:40:10Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![eureka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eureka/32/28992_2.png) [@eureka](https://discuss.elastic.co/u/eureka)\ **Post date:** [March 19, 2018, 7:40am UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/1 "2018-03-19T07:40:10Z")
Hello, I'm new to the stack. I have a bunch of logs I wanted to try out, I was only able to get auditd module working (commented out below) **filebeat.yml** ```auto filebeat.modules: - module: system syslog: enabled: true var.paths: ["/media/sf_Work/elastic/project-data/n1/ec2/log/messages"] auth: enabled: true var.paths: ["/media/sf_Work/elastic/project-data/n1/ec2/log/secure"] # - module: auditd # log: # enabled: true # var.paths: ["/media/sf_Work/elastic/project-data/n1/ec2/log/audit/*"] ``` I would run the following command for entry: _filebeat -e -v -c ./filebeat.yml -strict.perms=false_ and place logs where they should be. I don't get any errors but I wouldn't get any system module related docs. (again, auditd works) Do I have to write some sort of custom parser or am I missing something? Thank you, ---
**Author:** ![eureka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eureka/32/28992_2.png) [@eureka](https://discuss.elastic.co/u/eureka)\ **Post date:** [March 19, 2018, 11:20pm UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/2 "2018-03-19T23:20:26Z")
anyone? ☹ ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [March 20, 2018, 1:13am UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/3 "2018-03-20T01:13:14Z")
When you run Filebeat, you should see an info message like: ```auto 2018-03-19T18:11:08.948-0700 INFO log/harvester.go:216 Harvester started for file:... ``` If you don't, make sure you specify the correct glob pattern to find the files. For example: `var.paths: ["/media/sf_Work/elastic/project-data/n1/ec2/log/messages/*"]` See the [Filebeat docs](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#prospector-paths) about the `paths` option for more about supported glob patterns. If that doesn't solve your problem, please format your config example as code (wrap in triple backticks) and also provide the Filebeat version and the console output that you see when you run Filebeat with the -e option specified. ---
**Author:** ![eureka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eureka/32/28992_2.png) [@eureka](https://discuss.elastic.co/u/eureka)\ **Post date:** [March 20, 2018, 1:48am UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/4 "2018-03-20T01:48:06Z")
Thank you so much for replying. ```auto |2018-03-19T18:38:31.168-0700|INFO|log/prospector.go:111|Configured paths: [/var/log/auth.log* /var/log/secure*]| |---|---|---|---| |2018-03-19T18:38:31.174-0700|INFO|log/harvester.go:216|Harvester started for file: /var/log/auth.log| |2018-03-19T18:38:31.183-0700|INFO|log/prospector.go:111|Configured paths: [/media/sf_Work/elastic/project-data/n1/ec2/log/secure/*]| |2018-03-19T18:38:31.196-0700|INFO|log/prospector.go:111|Configured paths: [/media/sf_Work/elastic/project-data/n1/ec2/log/audit/*]| |2018-03-19T18:38:31.196-0700|INFO|crawler/crawler.go:82|Loading and starting Prospectors completed. Enabled prospectors: 3| |2018-03-19T18:38:31.244-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/audit/audit.log.1| |2018-03-19T18:38:31.286-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/audit/audit.log.2| |2018-03-19T18:38:31.294-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/audit/audit.log.3| |2018-03-19T18:38:31.339-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/audit/audit.log| |2018-03-19T18:38:31.380-0700|INFO|elasticsearch/client.go:690|Connected to Elasticsearch version 6.2.2| |2018-03-19T18:38:31.405-0700|INFO|template/load.go:73|Template already exists and will not be overwritten.| |2018-03-19T18:38:51.388-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/secure/secure| |2018-03-19T18:38:51.477-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/secure/secure-20171112| |2018-03-19T18:38:51.907-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/secure/secure-20171119| |2018-03-19T18:38:52.123-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/secure/secure-20171126| |2018-03-19T18:38:52.259-0700|INFO|log/harvester.go:216|Harvester started for file: /media/sf_Work/elastic/project-data/n1/ec2/log/secure/secure-20171203| ``` Not same as the original config but it seems alright. Although I don't understand why /var/log/auth.log is being harvested because I have no config for that. ```auto Nov 6 03:00:42 ip-172-31-28-22 sshd[15386]: Accepted publickey for ec2-user from 192.168.11.14 port 39638 ssh2: RSA SHA256:zJaK017NHbZJCdAFdN3YEOFXOvP+gT3edI+rO00xIPs ``` This is part of secure log and I realized it doesn't have year. Could that be a potential issue? ---
**Author:** ![dedemorton](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dedemorton/32/84409_2.png) [@dedemorton](https://discuss.elastic.co/u/dedemorton)\ **Post date:** [March 20, 2018, 7:10am UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/5 "2018-03-20T07:10:38Z")
> [@eureka](#): > > I don't understand why /var/log/auth.log is being harvested because I have no config for that. Is it possible that you are running Filebeat with the system module enabled in both the filebeat.yml _and_ modules.d directory? The default config in the modules.d directory reads /var/log/auth.log. Run `filebeat modules list` to see the list of enabled modules. See the [Filebeat docs](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html#configuration-filebeat-modules) for more about enabling modules. Regarding your question about that year: if the year isn't specified in the log file, Filebeat sets it to the current year automatically. ---
**Author:** ![eureka](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/eureka/32/28992_2.png) [@eureka](https://discuss.elastic.co/u/eureka)\ **Post date:** [March 20, 2018, 11:39pm UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/6 "2018-03-20T23:39:32Z")
Thank you so much for helping out. You were right about the enabled modules. However I ended up using logstash, groking files directly and got what I wanted ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 18, 2018, 1:40am UTC](https://discuss.elastic.co/t/filebeat-secure-messages-for-centos/124496/7 "2018-04-18T01:40:02Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.