# Filebeat zeek module shows no data

**URL:** <https://discuss.elastic.co/t/filebeat-zeek-module-shows-no-data/310707>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 27, 2022, 5:05am UTC](https://discuss.elastic.co/t/filebeat-zeek-module-shows-no-data/310707 "2022-07-27T05:05:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bakhtawar](https://avatars.discourse-cdn.com/v4/letter/b/a88e57/32.png) [@Bakhtawar](https://discuss.elastic.co/u/Bakhtawar)\
**Post date:** [July 27, 2022, 5:05am UTC](https://discuss.elastic.co/t/filebeat-zeek-module-shows-no-data/310707/1 "2022-07-27T05:05:15Z")

</div>

Hi, I followed the steps mentioned in your blog to send zeek logs to elastic. I installed zeek version 4.0.7 and filebeat version 7.17.5. Elasticsearch and kibana version is 7.15.0. Filebeats is unable to send zeek logs to elastic under the category event.module : “zeek”. Rather logs are visible in discover tab in general.

@timestamp:  
Jul 26, 2022 @ 08:56:48.537  
agent.ephemeral\_id:  
a330a046-34d5-48a0-8a57-c24ba0d97fe4  
agent.hostname:  
bakhtawar  
agent.id:  
5542248b-ad82-4666-be57-6cb13db685de  
agent.name:  
bakhtawar  
agent.type:  
filebeat  
agent.version:  
7.17.5  
container.id:  
ssl.log  
ecs.version:  
1.12.0  
host.architecture:  
x86\_64  
host.containerized:  
false  
host.hostname:  
bakhtawar  
host.id:  
fd55a894765441258c780e102d780210  
host.ip:  
10.0.2.5, fe80::9b4:1ec:5e3a:c4c4  
host.mac:  
08:00:27:0e:7f:66  
host.name:  
bakhtawar  
host.os.codename:  
focal  
host.os.family:  
debian  
host.os.kernel:  
5.15.0-41-generic  
host.os.name:  
Ubuntu  
host.os.platform:  
ubuntu  
host.os.type:  
linux  
host.os.version:  
20.04.3 LTS (Focal Fossa)  
input.type:  
filestream  
log.file.path:  
/opt/zeek/logs/current/ssl.log  
log.offset:  
10,392  
message:

However, when I view the logs under event module zeek, it shows no results. Can you please tell why is it showing this abnormal behaviour? Thankyou.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 24, 2022, 7:05am UTC](https://discuss.elastic.co/t/filebeat-zeek-module-shows-no-data/310707/2 "2022-08-24T07:05:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.