# Sophos module not working

**URL:** <https://discuss.elastic.co/t/sophos-module-not-working/245629>\
**Category:** SIEM\
**Created:** [August 19, 2020, 3:06pm UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629 "2020-08-19T15:06:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\
**Post date:** [August 19, 2020, 3:06pm UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629/1 "2020-08-19T15:06:55Z")

</div>

So I have been waiting for the Sophos XG module for some time since we use Sophos XG FW and when I got to know that 7.9 was released I quickly updated my filebeat and tried setting up the ingest pipeline for sophos but then it threw an error.

```auto
[root@WEBWORKS-LOGSTASH filebeat]# filebeat setup --pipelines --modules sophos
Exiting: 1 error: Error loading pipeline for fileset sophos/xg: couldn't load pipeline: couldn't load json. Error: 400 Bad Request: {"error":{"root_cause":[{"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"}],"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"},"status":400}. Response body: {"error":{"root_cause":[{"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"}],"type":"parse_exception","reason":"processor [set] doesn't support one or more provided configuration parameters [ignore_empty_value]","processor_type":"set"},"status":400}

```

---

<div class="post-metadata">

**Author:** ![AngelaChuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelachuang/32/49719_2.png) [@AngelaChuang](https://discuss.elastic.co/u/AngelaChuang)\
**Post date:** [August 19, 2020, 7:00pm UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629/2 "2020-08-19T19:00:33Z")

</div>

Hello @Ameer_Mukadam, please try to remove 'ignore\_empty\_value' from the 'set' processor, and make sure you use ES 7.9.

---

<div class="post-metadata">

**Author:** ![Ameer\_Mukadam](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ameer_mukadam/32/47196_2.png) [@Ameer\_Mukadam](https://discuss.elastic.co/u/Ameer_Mukadam)\
**Post date:** [August 20, 2020, 8:56am UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629/3 "2020-08-20T08:56:50Z")

</div>

Sorry my bad, I thought only updating the filebeat will do it. I updated ES today and it worked. Thank you very much.

---

<div class="post-metadata">

**Author:** ![AngelaChuang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/angelachuang/32/49719_2.png) [@AngelaChuang](https://discuss.elastic.co/u/AngelaChuang)\
**Post date:** [August 24, 2020, 8:13am UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629/4 "2020-08-24T08:13:23Z")

</div>

No worries, happy to help 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2020, 8:13am UTC](https://discuss.elastic.co/t/sophos-module-not-working/245629/5 "2020-09-21T08:13:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.