# Problems with Filebeat's auditd module

**URL:** <https://discuss.elastic.co/t/problems-with-filebeats-auditd-module/233520>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 20, 2020, 11:30am UTC](https://discuss.elastic.co/t/problems-with-filebeats-auditd-module/233520 "2020-05-20T11:30:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mrlhansen](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@mrlhansen](https://discuss.elastic.co/u/mrlhansen)\
**Post date:** [May 20, 2020, 11:30am UTC](https://discuss.elastic.co/t/problems-with-filebeats-auditd-module/233520/1 "2020-05-20T11:30:09Z")

</div>

Hi,

We are currently using filebeat+logstash to send our log files to Elasticsearch, and it works fine. However, we would like to send the files directly from filebeat in the future, but we are getting tons of errors like the one shown below. It looks like the problem is related to the `auditd` module.

```auto
May 20 12:42:20 <hostname> filebeat: 2020-05-20T12:42:20.037+0200#011WARN#011[elasticsearch]#011elasticsearch/client.go:384#011Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xbfa9603eecb270c6, ext:116471983, loc:(*time.Location)(0x594e5e0)}, Meta:{"pipeline":"filebeat-7.7.0-auditd-log-pipeline"}, Fields:{"agent":{"ephemeral_id":"e28f8910-c7e0-4982-b976-c33ac837060c","hostname":"<hostname>","id":"daf30849-9a42-4c10-a668-0c3dbd13d451","type":"filebeat","version":"7.7.0"},"ecs":{"version":"1.5.0"},"event":{"dataset":"auditd.log","module":"auditd"},"fileset":{"name":"log"},"host":{"name":"<hostname>"},"input":{"type":"log"},"log":{"file":{"path":"/var/log/audit/audit.log.1"},"offset":1555232},"message":"<message>","service":{"type":"auditd"}}, Private:file.State{Id:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000c60270), Source:"/var/log/audit/audit.log.1", Offset:1555342, Timestamp:time.Time{wall:0xbfa9603eeb75077d, ext:95670131, loc:(*time.Location)(0x594e5e0)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x47, Device:0xfc04}}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=403): {"type":"security_exception","reason":"action [indices:admin/create] is unauthorized for user [<username>]"}

```

Our configuration file for filebeats looks like this:

```auto
filebeat.inputs:
- type: log
  enabled: true
  fields:
    index: foo
  paths:
    - /path1
    - /path2
- type: log
  enabled: true
  fields:
    index: bar
  paths:
    - /path1
    - /path2

filebeat.modules:
- module: auditd
  log.enabled: true

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml
  reload.enabled: false

setup.template:
  name: "foo"
  pattern: "foo-*"
  enabled: true
  overwrite: false

setup.ilm:
  enabled: false

output.elasticsearch:
  hosts: ["<ip>"]
  protocol: "http"
  username: "<username>"
  password: "<password>"
  index: "%{[fields.index]}-%{+yyyy.MM.dd}"

```

The user in elasticsearch has access to the two indices `foo` and `bar` and both have been initialized with a template. Other log files are being indexed in Elastic and there are also entries from the audit log, so at least some of the audit log is processed correctly.

---

<div class="post-metadata">

**Author:** ![mrlhansen](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@mrlhansen](https://discuss.elastic.co/u/mrlhansen)\
**Post date:** [May 22, 2020, 11:51am UTC](https://discuss.elastic.co/t/problems-with-filebeats-auditd-module/233520/2 "2020-05-22T11:51:40Z")

</div>

I am still not closer to a solution. Everything works if we disable the `auditd` module. The last part of the error

```nohighlight
action [indices:admin/create] is unauthorized for user [<username>]

```

seems to indicate missing permissions, but the user has both `create` and `create_index` permissions on the relevant indices.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 19, 2020, 11:54am UTC](https://discuss.elastic.co/t/problems-with-filebeats-auditd-module/233520/3 "2020-06-19T11:54:49Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.