# Mac Mojave, Filebeat, System Module, no syslogs sent

**URL:** <https://discuss.elastic.co/t/mac-mojave-filebeat-system-module-no-syslogs-sent/158079>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 25, 2018, 12:08am UTC](https://discuss.elastic.co/t/mac-mojave-filebeat-system-module-no-syslogs-sent/158079 "2018-11-25T00:08:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DPattee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpattee/32/37772_2.png) [@DPattee](https://discuss.elastic.co/u/DPattee)\
**Post date:** [November 25, 2018, 12:08am UTC](https://discuss.elastic.co/t/mac-mojave-filebeat-system-module-no-syslogs-sent/158079/1 "2018-11-25T00:08:42Z")

</div>

There are 2 issues I'm encountering using filebeat on my Mac. Older versions of filebeat, elastic, and Mac OS worked, but I've decom'd those servers so can't do any direct comparisons.

`filebeat version 6.5.0 (amd64), libbeat 6.5.0 [ff5b9b3db49856a25b5eda133b6997f2157a4910 built 2018-11-09 17:55:54 +0000 UTC]`

**Issue 1: System module doesn't send anything**  
Enabling the default system.yml

```
    - module: system
    # Syslog
     syslog:
     enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

    # Convert the timestamp to UTC. Requires Elasticsearch >= 6.1.
    #var.convert_timezone: false

  # Authorization logs
  auth:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    #var.paths:

    # Convert the timestamp to UTC. Requires Elasticsearch >= 6.1.
    #var.convert_timezone: false

```

And a filebeat.yml that has been modified as follows (excerpts):

```
filebeat.inputs:
- type: log
  enabled: false
filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: true
  reload.period: 60s
filebeat.modules:

```

No log messages are ever sent. Tailing system.log file on that machine shows messages correctly appearing in it.

When running filebeat from the console (sudo ./filebeat -e -v) there are lines that show it has found the log, but then nothing.

`2018-11-24T15:44:47.085-0800	INFO	log/harvester.go:254	Harvester started for file: /var/log/system.log`

**Issue 2: Using Input Type Log system.log doesn't get sent as parsed syslog entries**  
With the default filebeat.yml that includes

```
filebeat.inputs: 
type: log enabled: true 
paths: - /var/log/*.log 

```

I get tons of messages in elastic, as I'd expect.

But, the messages are not parsed they just show up with prospector.type: log, input.type: log, message: .

The old system.syslog.pid, .message, .program, .hostnames don't ever get added.

Where have I taken a wrong turn? 🙂

---

<div class="post-metadata">

**Author:** ![DPattee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dpattee/32/37772_2.png) [@DPattee](https://discuss.elastic.co/u/DPattee)\
**Post date:** [November 26, 2018, 12:15am UTC](https://discuss.elastic.co/t/mac-mojave-filebeat-system-module-no-syslogs-sent/158079/2 "2018-11-26T00:15:33Z")

</div>

I resolved this, leaving it up in case anyone searches for the same issues.

After deleting the indexes many times and tweaking the .yml many times, ultimately deleting the pipelines was what solved it.

DELETE filebeat-\*  
DELETE \_ingest/pipeline/filebeat-\*

And then a ./filebeat setup --templates and --pipelines to get things back up.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2018, 12:15am UTC](https://discuss.elastic.co/t/mac-mojave-filebeat-system-module-no-syslogs-sent/158079/3 "2018-12-24T00:15:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.