# PanW module issues

**URL:** https://discuss.elastic.co/t/panw-module-issues/260487
**Category:** Beats
**Tags:** filebeat
**Created:** [January 7, 2021, 8:34pm UTC](https://discuss.elastic.co/t/panw-module-issues/260487 "2021-01-07T20:34:47Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![S3l3ct3d](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/s3l3ct3d/32/77965_2.png) [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)
#### Post date: [January 7, 2021, 8:34pm UTC](https://discuss.elastic.co/t/panw-module-issues/260487/1 "2021-01-07T20:34:47Z")

</div>

I have the panw module enabled in filebeat along with other modules enabled as well. For the panw module I have configured it as shown below

```auto
- module: panw
  panos:
    enabled: true

    # Set which input to use between syslog (default) or file.
    var.input: syslog
    var.syslog_host: localhost
    var.syslog_port: 9004

```

I am also sending this to via logstash to the ELK stack.

So my palo.conf file is listed below as well.

```auto
input {
        beats{
                port => 9004
        }
}

filter {

}

output {
        stdout {}

# elasticsearch {
# hosts => ["<elasticsearchhost>"]
# user => "<changeme>"
# password => "<changeme>"
# index => "paloalto-000001"
# }
}

```

When I stop filebeat and logstash services and run netcat to listen on the specified udp port, I can see the data come in with no issue.

When I start filebeat, and then run bin/logstash -f /etc/logstash/conf.d/palo.conf to test my config and to make sure that everything is printing to screen properly, nothing shows. Just like I am not receiving any data at all.

Which I know is not accurate as netcat shows data coming in. I am not sure if the disconnect is in my filebeat.yml or the filebeat module, or even in my logstash.yml or palo.conf file.

Any suggestions would be helpful.

Thanks,

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 4, 2021, 10:35pm UTC](https://discuss.elastic.co/t/panw-module-issues/260487/2 "2021-02-04T22:35:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.