# Filebeat system module parse messages

**URL:** <https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 19, 2017, 9:10am UTC](https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849 "2017-04-19T09:10:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nbrys](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nbrys/32/17374_2.png) [@nbrys](https://discuss.elastic.co/u/nbrys)\
**Post date:** [April 19, 2017, 9:10am UTC](https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849/1 "2017-04-19T09:10:47Z")

</div>

I've just started using filebeat and the apache2 and system module. The apache2 module parses all messages and exporting a nice number of fields. Is there any news if the system module will do the same? I'm mostly interesting in parsing the auth.log file. Of is there any other way to accomplish this?

Our filebeat module sends the logs directly to elasticsearch

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 19, 2017, 1:23pm UTC](https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849/2 "2017-04-19T13:23:30Z")

</div>

In the 5.4 release, the system module will do auth logs as well. [https://www.elastic.co/guide/en/beats/filebeat/5.x/exported-fields-system.html#\_auth\_fields](https://www.elastic.co/guide/en/beats/filebeat/5.x/exported-fields-system.html#_auth_fields)

There's a blog post about it too. [https://www.elastic.co/blog/grokking-the-linux-authorization-logs](https://www.elastic.co/blog/grokking-the-linux-authorization-logs)

If you want to test the latest build from master you can use our [snapshots](https://beats-nightlies.s3.amazonaws.com/index.html?prefix=filebeat/).

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 17, 2017, 1:26pm UTC](https://discuss.elastic.co/t/filebeat-system-module-parse-messages/82849/3 "2017-05-17T13:26:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.