Module system doesn't exists! when trying to enable system module

I'm trying to get system logs from an Ubuntu VM running the latest version of filebeats (installed via apt-get). When I run sudo ./filebeat modules enable system, I get an error "Module system doesn't exists!".
If I run sudo ./filebeat modules list, I get blank outputs for Enabled and Disabled.

Did I miss a step somewhere?

Hi @Josh_McDonald,

If you installed filebeat using apt-get you should drop ./ from the command, as filebeat is already in the path. Try with just:

 sudo filebeat modules list
1 Like

I get the same output just using sudo filebeat modules listNothing enabled or disabled.

I also tried sudo filebeat modules enable system, but I get an error: Module system doesn't exists!

Hi @Josh_McDonald, I'm wondering. Did you use our official package from or installed it from somewhere else?

Could you dump the output of dpkg -L filebeat? I want to make sure your setup has the module files.

Best regards

I used the official instructions from here:

I can't attach the full output since it won't let me attach a txt file and it's too long to paste into a reply.
Here are the bits that seem relevant to modules for system. There are a number of others related to modules as well.



there should be some more under /etc/modules.d, do you see those?

I have the following related to /etc


Everything seems in place, I would say something on this list should be the issue:

  • You are running sudo filebeat... from /usr/share/filbeat folder, no need for it, depending on your PATH settings it may be using the wrong binary, just run the command from your home, for instance.
  • filebeat.config.modules.path is wrong, did you change by a chance? You can dump your settings doing filebeat export config.

Best regards

Running from my home directory doesn't have any impact and I get the same results. The modules path may be the root cause here because I believe I likely changed it due to errors before (likely because I was running it incorrectly).
Here's the config output
path: /usr/share/filebeat/modules/*.yml
enabled: true

  • enabled: false
    • /var/log/*.log
      type: log
      config: /etc/filebeat
      data: /var/lib/filebeat
      home: /usr/share/filebeat
      logs: /var/log/filebeat
      number_of_shards: 3

I think you found the root cause :), modules section should look like this:

#============================= Filebeat modules ===============================

  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

Then you can try the command without ./ again.

Best regards

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.