# Filebeat setup: "Exiting: module system is configured but has no enabled filesets"

**URL:** https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584
**Category:** Beats
**Tags:** filebeat
**Created:** [August 6, 2022, 6:35pm UTC](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584 "2022-08-06T18:35:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![JoeShabadu2000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joeshabadu2000/32/109326_2.png) [@JoeShabadu2000](https://discuss.elastic.co/u/JoeShabadu2000)
#### Post date: [August 6, 2022, 6:35pm UTC](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584/1 "2022-08-06T18:35:51Z")

</div>

I'm trying to set up filebeat on Ubuntu, to send system log data to Logstash. I am having issues setting up the "filebeat system" module.

Upon running:

`sudo filebeat setup --pipelines --modules system`

I receive the error message

`Exiting: module system is configured but has no enabled filesets`

I know this has to do with the modules.d/system.yml config but nothing I do seems to work. This is on an Ubuntu 22.04 VM running in Azure. I confirmed the same issue on 20.04. From creating the VM in Azure, here are the exact steps taken upon first login:

```auto
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo gpg --dearmor -o /usr/share/keyrings/elasticsearch-keyring.gpg

echo "deb [signed-by=/usr/share/keyrings/elasticsearch-keyring.gpg] https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee /etc/apt/sources.list.d/elastic-8.x.list

sudo apt-get update

sudo apt-get install filebeat -y

sudo filebeat modules enable system

sudo vim /etc/filebeat/modules.d/system.yml

```

At this point I edit the system.yml file so that it reads as follows:

```auto
# Docs: https://www.elastic.co/guide/en/beats/filebeat/8.3/filebeat-module-system.html

- module: system
  # Syslog
  syslog:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

  # Authorization logs
  auth:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

```

Then when I run:

`sudo filebeat setup --pipelines --modules system`

I receive the error

`Exiting: module system is configured but has no enabled filesets`

This appears to be the same issue as mentioned in the closed topic located at:

> [@Filebeat system pipeline setup fails](https://discuss.elastic.co/t/filebeat-system-pipeline-setup-fails/307872):
>
> I've enabled the system module, enabled syslog and auth in system.yml. Yet for some reason I still get this error: $ sudo filebeat setup --pipelines --modules system Exiting: module system is configured but has no enabled filesets What else must I do, what am I missing?! This is a Filebeat install on a Ubuntu 20.04 Logstash node, Elasticsearch and Kibana reside on separate servers. $ filebeat version filebeat version 8.2.3 (amd64), libbeat 8.2.3 [7826dc5e91c6e6d2487e05d3a8298f49041cd5c2 buil…

That one didn't get any replies but I'm also having the issue so I'll post again. Thanks very much to anyone with any insight for me!

---

<div class="post-metadata">

### Author: ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [August 7, 2022, 9:40pm UTC](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584/2 "2022-08-07T21:40:14Z")

</div>

There is this confusing thread on github: [[Filebeat-8.1] module is configured with datasets enabled, but unable to setup · Issue #30916 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/30916)

And a possible work around here: [https://www.reddit.com/r/elasticsearch/comments/w8g64e/problems\_with\_enabling\_filesets\_in\_filebeat/](https://www.reddit.com/r/elasticsearch/comments/w8g64e/problems_with_enabling_filesets_in_filebeat/)

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 7, 2022, 11:41pm UTC](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584/3 "2022-08-07T23:41:43Z")

</div>

hi @JoeShabadu2000 Welcome to the community, apologies looks like perhaps you stumbled into a bug on your first try 🙂 I think the docs may be a bit out of date as I don't think you need to specify the modules list any more.

> [@JoeShabadu2000](#):
>
> filebeat setup --pipelines --modules system

Yup looks like a bug

this options works for me without naming the module  
`./filebeat setup --pipelines -e`

and full setup work as well  
`./filebeat setup -e`

In general running the full setup is most safe / complete in my opinion.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 5, 2022, 1:42am UTC](https://discuss.elastic.co/t/filebeat-setup-exiting-module-system-is-configured-but-has-no-enabled-filesets/311584/4 "2022-09-05T01:42:02Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
