# Fileset suricata/test is configured but doesn't exist

**URL:** <https://discuss.elastic.co/t/fileset-suricata-test-is-configured-but-doesnt-exist/355510>\
**Category:** Elasticsearch\
**Created:** [March 15, 2024, 4:42pm UTC](https://discuss.elastic.co/t/fileset-suricata-test-is-configured-but-doesnt-exist/355510 "2024-03-15T16:42:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![e-ferrari](https://avatars.discourse-cdn.com/v4/letter/e/898d66/32.png) [@e-ferrari](https://discuss.elastic.co/u/e-ferrari)\
**Post date:** [March 15, 2024, 4:42pm UTC](https://discuss.elastic.co/t/fileset-suricata-test-is-configured-but-doesnt-exist/355510/1 "2024-03-15T16:42:56Z")

</div>

Hi,  
i'm running ELK 8.12.1 on Ubuntu 22.04 LTS.  
I try to rename a fileset (don't know if this is possible).  
What i found in the net was this:  
/etc/filebeat/modules.d/suricata.yml:

```auto
- module: suricata
  eve:
    enabled: false
    var.paths: ["/var/log/suricata/eve.json"]

  test:
    enabled: true
    var.paths: ["/var/log/suricata/eve.json"]

```

I disabled the old fileset (eve) and tried to enable a fileset with another name:test.  
Then i did:  
`filebeat setup --pipelines -e`  
I got this error:

...  
`{"log.level":"error","@timestamp":"2024-03-15T17:40:14.332+0100","log.logger":"load","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cfgfile.(*RunnerList).Reload","file.name":"cfgfile/list.go","file.line":138},"message":"Error creating runner from config: fileset suricata/test is configured but doesn't exist","service.name":"filebeat","ecs.version":"1.6.0"}`

Thanks for any help.

Bernd

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 12, 2024, 4:43pm UTC](https://discuss.elastic.co/t/fileset-suricata-test-is-configured-but-doesnt-exist/355510/2 "2024-04-12T16:43:46Z")

</div>

Closed on April 12, 2024, 4:43pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.