Filebeat setup reports missing module/suricata

Hey folks! :wave:

It's my first post here, so please excuse any mistakes I might make.

I've started to set up Filebeat, Elastic and Kibana to connect Suricata to Grafana two days ago. Yesterday night at 3am I finally thought that everything is working buuuttt ... It didn't :melting_face:

My Suricata Dashboard at https://host:5601 is completely empty. So I took a closer look at the output of filebeat setup -e and this is one of the last lines:

{
   "log.level":"error",
   "@timestamp":"2024-04-03T11:47:18.485+0200",
   "log.origin":{
      "function":"github.com/elastic/beats/v7/libbeat/cfgfile.(*Reloader).Load",
      "file.name":"cfgfile/reload.go",
      "file.line":255
   },
   "message":"Error loading configuration files: 1 error: Error creating runner from config: error getting filesets for module suricata: open /usr/share/filebeat/module/suricata: no such file or directory",
   "service.name":"filebeat",
   "ecs.version":"1.6.0"
}

So it seems like either the fileset config is wrong, or I'm missing the suricata module for filebeat.

However, filebeat modules enable suricata returns Module suricata is already enabled. So in my untrained head that means that filebeat knows what the suricata module is, even though it can't load it during setup.

What would be the best approch to debug this issue?
Is there any config files you guys need in order to dig into this?

Thanks in advance everyone and have an amazing day! :slight_smile:

Regards,
Jamo

Hello Jamo,

By reading the error message we can see that filebeat is looking for files under the following path: /usr/share/filebeat/module/suricata

I've check on my install on a debian machine and i confirm that the directory exists.

How did you install filebeat?

Thanks

Hi @metie ,

thanks for your reply!

That's good to know :thinking:

I've followed the official guide at Filebeat quick start: installation and configuration | Filebeat Reference [8.13] | Elastic

I think I might just reinstall filebeat at this point.

Hello @Jamo ,

I've check the reference filebeat.yml. While I did not validate this through functional configuration, it seems that you need to set the paths section to point to where you installed filebeat.

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-reference-yml.html

https://www.elastic.co/guide/en/beats/filebeat/current/configuration-path.html

You can also validate that you have the correct path first by specifying the --path.home arguments to filebeat.

As an example, it should look like this: filebeat --path.home '/home/filebeat setup -e

Here is the reference to the command line argument specification

https://www.elastic.co/guide/en/beats/filebeat/current/command-line-options.html

Thanks!