# No iptables in elasticsearch

**URL:** <https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 30, 2022, 2:49am UTC](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770 "2022-01-30T02:49:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mevan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mevan/32/101086_2.png) [@mevan](https://discuss.elastic.co/u/mevan)\
**Post date:** [January 30, 2022, 2:49am UTC](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770/1 "2022-01-30T02:49:39Z")

</div>

I'm very new to filebeat/Elasticsearch so unsure how to debug this. I have filebeat, Elasticsearch and kibana working. I can see many of my logs being ingested from /var/log/syslog. However, although I have the [iptables module](https://www.elastic.co/guide/en/beats/filebeat/7.16/filebeat-module-iptables.html) enabled (see below) I don't see anything in my index from this source. For example, I've searched for keywords 'ubnt', 'WAN\_LOCAL', '129.124' and so on. Here is an example of one of the iptables log entries which are written to my /var/log/syslog (from an Ubiquti router):

```auto
Jan 27 05:18:09 ubnt kernel: [WAN_LOCAL-default-D]IN=eth0 OUT= MAC=f0:99:cc:ff:25:fx:44:a7:71:94:a1:c0:08:00 SRC=129.124.61.2 DST=35.80.14.77 LEN=40 TOS=0x08 PREC=0x20 TTL=223 ID=51920 PROTO=TCP SPT=41682 DPT=3151 WINDOW=1024 RES=0x00 SYN URGP=0

```

```auto
# filebeat modules list
Enabled:
elasticsearch
haproxy
iptables
kibana
nginx
system

```

---

<div class="post-metadata">

**Author:** ![mevan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mevan/32/101086_2.png) [@mevan](https://discuss.elastic.co/u/mevan)\
**Post date:** [January 30, 2022, 9:38pm UTC](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770/2 "2022-01-30T21:38:13Z")

</div>

trying again here: [Iptables module not working - filebeat or elastic?](https://discuss.elastic.co/t/iptables-module-not-working-filebeat-or-elastic/295788)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 27, 2022, 11:38pm UTC](https://discuss.elastic.co/t/no-iptables-in-elasticsearch/295770/3 "2022-02-27T23:38:57Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.