# Processor in auditd module fails

**URL:** <https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 1, 2022, 9:51pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693 "2022-07-01T21:51:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![parisila](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@parisila](https://discuss.elastic.co/u/parisila)\
**Post date:** [July 1, 2022, 9:51pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693/1 "2022-07-01T21:51:40Z")

</div>

I have a processor defined in the auditd module and seems to be correct based on other posts I have read. No configuration errors and filebeat starts up but I get an error

> ERROR instance/beat.go:989 Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: fileset auditd/input is configured but doesn't exist

This seems to be similar to a post found at this link but it did not solve my issue: [System module: error when defining syslog.input.processors](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865)

Here is my configuration:

```auto
# Module: auditd
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.15/filebeat-module-auditd.html

- module: auditd

  log:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/*/audit*"]

  input:
    processors:
      - dissect:
          tokenizer: "%{imfile.timestamp} %{related.hosts} %{imfile.tag} %{message}"
          field: "message"
          target_prefix: ""
          overwrite_keys: "true"

```

Any thoughts on how to resolve this? Where would I look to see if there are processors predefined in the auditd module as noted in the similar post for the system module?

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [July 4, 2022, 12:07pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693/2 "2022-07-04T12:07:07Z")

</div>

Hey @parisila, welcome to discuss 🙂

I think that there is an indentation problem in your configuration file. `input should be at the same level as `var.paths`, like this:

```auto
- module: auditd

  log:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths: ["/var/log/*/audit*"]

    input:
      processors:
        - dissect:
            tokenizer: "%{imfile.timestamp} %{related.hosts} %{imfile.tag} %{message}"
            field: "message"
            target_prefix: ""
            overwrite_keys: "true"

```

Otherwise, `input` is interpreted by filebeat as a different fileset, instead of being interpreted as the input of the `log` fileset.

---

<div class="post-metadata">

**Author:** ![parisila](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@parisila](https://discuss.elastic.co/u/parisila)\
**Post date:** [July 4, 2022, 6:38pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693/3 "2022-07-04T18:38:41Z")

</div>

Thank you! That resolved the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 1, 2022, 8:39pm UTC](https://discuss.elastic.co/t/processor-in-auditd-module-fails/308693/4 "2022-08-01T20:39:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.