I'm running filebeat 8.6.2.
I initially had it grabbing /var/log/remote.log and it worked fine.
Then I enabled the suricata module and set the configuration to this (excluding the output.elasticsearch section):
filebeat.inputs:
- type: log
paths:
- /var/log/remote.log
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- syslog:
field: message
format: auto
ignore_missing: false
ignore_failure: false
filebeat.modules:
- module: system
syslog:
enabled: true
auth:
enabled: true
- module: suricata
eve:
enabled: true
var.paths:
- "/var/log/suricata/eve.json"
var.internal_networks:
- private
running "filebeat -e run" ends with:
"log.level":"error","@timestamp":"2023-04-14T00:02:24.629Z","log.origin":{"file.name":"instance/beat.go","file.line":1071},"message":"Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: module suricata is configured but has no enabled filesets","service.name":"filebeat","ecs.version":"1.6.0"}
Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: module suricata is configured but has no enabled filesets
Digging around Google and GitHub shows various issues with running "filebeat -e setup" and pipeline issues. I had no problem running setup and Elasticsearch is populated properly. Filebeat just won't start.
It seems like a bug....because if I set the suricata module eve.enabled: false
, filebeat will spit out 12 lines of output and say Exiting: module suricata is configured but has no enabled filesets
.
If I set eve.enabled: true
, filebeat will spit out:
Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: module suricata is configured but has no enabled filesets
Additionally, I see:
{"log.level":"info","@timestamp":"2023-04-14T00:35:52.590Z","log.logger":"modules","log.origin":{"file.name":"fileset/modules.go","file.line":120},"message":"Enabled modules/filesets: system (auth), system (syslog), suricata (eve)","service.name":"filebeat","ecs.version":"1.6.0"}
...a few log lines into filebeat starting.
Thinking it had something to do with the dynamic reloading, I set filebeat.config.inputs.reload.enabled: false
to no avail.
It there something broken in the module reloader related to filesets?