Filebeat setup: "Exiting: module system is configured but has no enabled filesets"

I'm trying to set up filebeat on Ubuntu, to send system log data to Logstash. I am having issues setting up the "filebeat system" module.

Upon running:

sudo filebeat setup --pipelines --modules system

I receive the error message

Exiting: module system is configured but has no enabled filesets

I know this has to do with the modules.d/system.yml config but nothing I do seems to work. This is on an Ubuntu 22.04 VM running in Azure. I confirmed the same issue on 20.04. From creating the VM in Azure, here are the exact steps taken upon first login:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

sudo apt-get update

sudo apt-get install filebeat -y

sudo filebeat modules enable system

sudo vim /etc/filebeat/modules.d/system.yml

At this point I edit the system.yml file so that it reads as follows:

# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.3/filebeat-module-system.html

- module: system
  # Syslog
  syslog:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  # Authorization logs
  auth:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

Then when I run:

sudo filebeat setup --pipelines --modules system

I receive the error

Exiting: module system is configured but has no enabled filesets

This appears to be the same issue as mentioned in the closed topic located at:

That one didn't get any replies but I'm also having the issue so I'll post again. Thanks very much to anyone with any insight for me!

There is this confusing thread on github: [Filebeat-8.1] module is configured with datasets enabled, but unable to setup · Issue #30916 · elastic/beats · GitHub

And a possible work around here: https://www.reddit.com/r/elasticsearch/comments/w8g64e/problems_with_enabling_filesets_in_filebeat/

hi @JoeShabadu2000 Welcome to the community, apologies looks like perhaps you stumbled into a bug on your first try :slight_smile: I think the docs may be a bit out of date as I don't think you need to specify the modules list any more.

Yup looks like a bug

this options works for me without naming the module
./filebeat setup --pipelines -e

and full setup work as well
./filebeat setup -e

In general running the full setup is most safe / complete in my opinion.