# System module: error when defining syslog.input.processors

**URL:** <https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 3, 2020, 11:16am UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865 "2020-03-03T11:16:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![TatsuKishi](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@TatsuKishi](https://discuss.elastic.co/u/TatsuKishi)\
**Post date:** [March 3, 2020, 11:16am UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865/1 "2020-03-03T11:16:55Z")

</div>

Hey, I'm trying to define a processor in the system module just for syslog to drop certain spammy, non-relevant events. But when I define a drop\_event I get an error about a processor having multiple actions:  
#011ERROR#011fileset/factory.go:105#011Error creating input: each processor must have exactly one action, but found 2 actions (add\_locale,drop\_event)

According to the documentation that should be a valid location: [https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#where-valid](https://www.elastic.co/guide/en/beats/filebeat/current/defining-processors.html#where-valid)  
I also tried defining it in the modules top scope which failed with "Fileset system/input is configured but doesn't exist"

I'd rather avoid defining the processor at top scope since I have other inputs where this filter would just cause unnecessary computation.

Any help for this would be appreciated.

> **Config**
>
> ```
> - module: system
> # Syslog
> syslog:
> enabled: true
> input:
> processors:
> - drop_event:
> when:
> and:
> - contains:
> message: "error on subcontainer"
> - contains:
> message: "ia_addr"
> 
> # Authorization logs
> auth:
> enabled: true
> 
> ```

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [March 3, 2020, 6:57pm UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865/2 "2020-03-03T18:57:17Z")

</div>

Hey @TatsuKishi, welcome to discuss 🙂

This error can be a side effect of having processors predefined in modules. This `add_locale` processor is used by default, but your config tries to override it. Could you try to include this processor in your config? It would be something like this:

```auto
- module: system
  # Syslog
  syslog:
    enabled: true
    input:
      processors:
      - add_locale: ~
      - drop_event:
          when:
            and:
            - contains:
                message: "error on subcontainer"
            - contains:
                message: "ia_addr"

  # Authorization logs
  auth:
    enabled: true

```

Another option you have is to define your `drop_event` processor in the main configuration file of filebeat, but then you have to take into account that the processor would be applied to all events generated.

---

<div class="post-metadata">

**Author:** ![TatsuKishi](https://avatars.discourse-cdn.com/v4/letter/t/a88e4f/32.png) [@TatsuKishi](https://discuss.elastic.co/u/TatsuKishi)\
**Post date:** [March 4, 2020, 9:43am UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865/3 "2020-03-04T09:43:14Z")

</div>

Adding the "add\_locale" to the processors does the job, thank you!

Another thing I noticed is that this error was not picked up when doing a "filebeat check config". That threw me for quite the loop since it went through our CI due to that when it really shouldn't have.

---

<div class="post-metadata">

**Author:** ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)\
**Post date:** [March 4, 2020, 11:28am UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865/4 "2020-03-04T11:28:37Z")

</div>

> [@TatsuKishi](#):
>
> Another thing I noticed is that this error was not picked up when doing a "filebeat check config". That threw me for quite the loop since it went through our CI due to that when it really shouldn't have.

Yeah, probably filebeat considers this configuration correct, so config checks work, but later it cannot instantiate the pipelines because of the conflict with the predefined processors.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 1, 2020, 11:28am UTC](https://discuss.elastic.co/t/system-module-error-when-defining-syslog-input-processors/221865/5 "2020-04-01T11:28:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.