Module system doesn't exists! when trying to enable system module

Elastic Stack Beats
1

I'm trying to get system logs from an Ubuntu VM running the latest version of filebeats (installed via apt-get). When I run sudo ./filebeat modules enable system, I get an error "Module system doesn't exists!".
If I run sudo ./filebeat modules list, I get blank outputs for Enabled and Disabled.

Did I miss a step somewhere?

2

Hi @Josh_McDonald,

If you installed filebeat using apt-get you should drop ./ from the command, as filebeat is already in the path. Try with just:

 sudo filebeat modules list
1 Like
3

I get the same output just using sudo filebeat modules listNothing enabled or disabled.

4

I also tried sudo filebeat modules enable system, but I get an error: Module system doesn't exists!

5

Hi @Josh_McDonald, I'm wondering. Did you use our official package from https://www.elastic.co/downloads/beats/filebeat or installed it from somewhere else?

Could you dump the output of dpkg -L filebeat? I want to make sure your setup has the module files.

Best regards

6

I used the official instructions from here:
https://www.elastic.co/guide/en/beats/filebeat/current/setup-repositories.html

I can't attach the full output since it won't let me attach a txt file and it's too long to paste into a reply.
Here are the bits that seem relevant to modules for system. There are a number of others related to modules as well.

/usr/share/filebeat/module

/usr/share/filebeat/module/system
/usr/share/filebeat/module/system/auth
/usr/share/filebeat/module/system/auth/ingest
/usr/share/filebeat/module/system/auth/ingest/pipeline.json
/usr/share/filebeat/module/system/auth/config
/usr/share/filebeat/module/system/auth/config/auth.yml
/usr/share/filebeat/module/system/auth/manifest.yml
/usr/share/filebeat/module/system/syslog
/usr/share/filebeat/module/system/syslog/ingest
/usr/share/filebeat/module/system/syslog/ingest/pipeline.json
/usr/share/filebeat/module/system/syslog/config
/usr/share/filebeat/module/system/syslog/config/syslog.yml
/usr/share/filebeat/module/system/syslog/manifest.yml
/usr/share/filebeat/module/system/module.yml

7

there should be some more under /etc/modules.d, do you see those?

8

I have the following related to /etc

/etc/init.d
/etc/init.d/filebeat
/etc/filebeat
/etc/filebeat/modules.d
/etc/filebeat/modules.d/nginx.yml.disabled
/etc/filebeat/modules.d/system.yml.disabled
/etc/filebeat/modules.d/redis.yml.disabled
/etc/filebeat/modules.d/apache2.yml.disabled
/etc/filebeat/modules.d/postgresql.yml.disabled
/etc/filebeat/modules.d/icinga.yml.disabled
/etc/filebeat/modules.d/kafka.yml.disabled
/etc/filebeat/modules.d/auditd.yml.disabled
/etc/filebeat/modules.d/logstash.yml.disabled
/etc/filebeat/modules.d/osquery.yml.disabled
/etc/filebeat/modules.d/traefik.yml.disabled
/etc/filebeat/modules.d/mysql.yml.disabled
/etc/filebeat/filebeat.yml
/etc/filebeat/fields.yml
/etc/filebeat/filebeat.reference.yml

9

Everything seems in place, I would say something on this list should be the issue:

  • You are running sudo filebeat... from /usr/share/filbeat folder, no need for it, depending on your PATH settings it may be using the wrong binary, just run the command from your home, for instance.
  • filebeat.config.modules.path is wrong, did you change by a chance? You can dump your settings doing filebeat export config.

Best regards

10

Running from my home directory doesn't have any impact and I get the same results. The modules path may be the root cause here because I believe I likely changed it due to errors before (likely because I was running it incorrectly).
Here's the config output
filebeat:
config:
modules:
path: /usr/share/filebeat/modules/*.yml
reload:
enabled: true
prospectors:

  • enabled: false
    paths:
    • /var/log/*.log
      type: log
      output:
      elasticsearch:
      hosts:
    • 10.136.3.254:9200
      path:
      config: /etc/filebeat
      data: /var/lib/filebeat
      home: /usr/share/filebeat
      logs: /var/log/filebeat
      setup:
      kibana:
      host: 10.136.3.254:5601
      template:
      settings:
      index:
      number_of_shards: 3
11

I think you found the root cause :), modules section should look like this:

#============================= Filebeat modules ===============================

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

Then you can try the command without ./ again.

Best regards

1 Like
12

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.