# Iptables module not working - filebeat or elastic?

**URL:** <https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 30, 2022, 9:37pm UTC](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788 "2022-01-30T21:37:39Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![mevan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mevan/32/101086_2.png) [@mevan](https://discuss.elastic.co/u/mevan)\
**Post date:** [January 31, 2022, 2:13pm UTC](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788/2 "2022-01-31T14:13:50Z")

</div>

Resolved.

This offered insight: [Filebeat Iptables Overview / No results found](https://discuss.elastic.co/t/filebeat-iptables-overview-no-results-found/181881)

- `/var/log/iptables.log` must contain ONLY log entries of iptables format.
- It may be necessary to remove `/var/lib/filebeat/registry` (or rename to registry.bk) and restart filebeat
- To isolate logging from specific source with rsyslog:  
/etc/rsyslog.d/00-iptables.conf:

```auto
if $fromhost-ip=='192.168.1.1' then /var/log/iptables.log
& ~

```

---

_[View the full topic](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788)._