# \[Filebeat System\] New users and groups ECS Dashboard

**URL:** <https://discuss.elastic.co/t/filebeat-system-new-users-and-groups-ecs-dashboard/203619>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 15, 2019, 10:27am UTC](https://discuss.elastic.co/t/filebeat-system-new-users-and-groups-ecs-dashboard/203619 "2019-10-15T10:27:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tek\_Chand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tek_chand/32/34318_2.png) [@Tek\_Chand](https://discuss.elastic.co/u/Tek_Chand)\
**Post date:** [October 15, 2019, 10:27am UTC](https://discuss.elastic.co/t/filebeat-system-new-users-and-groups-ecs-dashboard/203619/1 "2019-10-15T10:27:32Z")

</div>

Hello Team,

We are in testing phase of ELK 7.4.0. Our architecture is Filebeat-\>Logstash-\>Elasticserach-\>Kibana.

We have used `system module` of filebeat with `logstash pipeline for parsing`and getting the logs on kibana dashboard as well as `syslog` logs are available over `syslog dashboard`.

We created a user on our filebeat machine and get the logs for same in `auth.log` which is visible in kibana dashboard also under `/var/log/auth.log`.

But `auth.log` are not avialable over `SSH Login` filebeat dashboard.

But when i checked `New users and groups` filebeat dashboard its not showing any information.

Even we are not found any `field` under Discover-\>Filebeat index data which show any new user is created. But full logs is available for new user created as shown below:

```auto
message	Oct 15 15:22:29 elkclient useradd[3453]: new user: name=tek, UID=1001, GID=1001, home=/home/tek, shell=/bin/bash

```

I am expecting when a new user add a filed should be there `system.auth.useradd` but its not available.

Earlier in version 6.4.0 when we used `Logstash pipeline for parsing` without `Filebeat module`  
we are getting below `fields` on the dashboard:

![Selection_056](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3bfa85fed043bf747fb8f520792e3a7d67ad3173.png)

But now we are not getting any such fileds. Logs are showing over kibana that logs are coming via filebeat module because we are getting filed like `event.dataset: system` and `event.module: system` etc.

We checked the `New users and groups ECS Dashboard` also but no data is there.

Can you please help me how we can get this data in dashboard so we can easily track if any new user or group is created on any machine.

Any help will be appreciated.

Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 12, 2019, 10:27am UTC](https://discuss.elastic.co/t/filebeat-system-new-users-and-groups-ecs-dashboard/203619/2 "2019-11-12T10:27:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.