# Unable to load software.log into elasticsearch
**URL:** https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309
**Category:** Beats
**Tags:** filebeat
**Created:** [June 3, 2022, 9:25am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309 "2022-06-03T09:25:14Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Chandrapaul](https://discuss.elastic.co/u/Chandrapaul)
#### Post date: [June 3, 2022, 9:25am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/1 "2022-06-03T09:25:15Z")
I'm trying to load software logs from zeek into Elasticsearch.
But if I run filebeat after adding software log path to zeek.yml in filebeat then I'm getting error :
"Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: fileset zeek/software is configured but doesn't exist".
How can this be resolved ?
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 3, 2022, 2:03pm UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/2 "2022-06-03T14:03:46Z")
Can you please share your `zeek.yml`
Did you enable the module?
`filebeat modules enable zeek`
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [June 4, 2022, 12:35am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/3 "2022-06-04T00:35:03Z")
There isn't a module for the zeek software log.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 4, 2022, 12:38am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/4 "2022-06-04T00:38:02Z")
> [@legoguy1000](#):
>
> There isn't a module for the zeek software log.
> **[Zeek (Bro) Module | Filebeat Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-zeek.html)**
```auto
hyperion:filebeat-8.2.0-darwin-x86_64 sbrown$ ls modules.d/ze*
modules.d/zeek.yml.disabled
```
@legoguy1000 Am I missing somegthing? You definitely made me flinch 🙂
---
### Author:  [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)
#### Post date: [June 4, 2022, 12:49am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/5 "2022-06-04T00:49:13Z")
Yes but it doesn't include every zeek log file. There is no fileset for the software.log.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 4, 2022, 12:52am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/6 "2022-06-04T00:52:45Z")
> [@Chandrapaul](#):
>
> "Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: fileset zeek/software is configured but doesn't exist".
@Chandrapaul Please share your `zeek.yml` then perhaps we can help you / understand what you are trying to accomplish.
---
### Author:  [@Chandrapaul](https://discuss.elastic.co/u/Chandrapaul)
#### Post date: [June 6, 2022, 7:45am UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/8 "2022-06-06T07:45:51Z")
```auto
- module: zeek
capture_loss:
enabled: true
var.paths: ["/opt/zeek/logs/current/capture_loss.log"]
connection:
enabled: true
var.paths: ["/opt/zeek/logs/current/conn.log"]
dce_rpc:
enabled: true
var.paths: ["/opt/zeek/logs/current/dce_rpc.log"]
dhcp:
enabled: true
var.paths: ["/opt/zeek/logs/current/dhcp.log"]
dnp3:
enabled: true
var.paths: ["/opt/zeek/logs/current/dnp3.log"]
dns:
enabled: true
var.paths: ["/opt/zeek/logs/current/dns.log"]
dpd:
enabled: true
var.paths: ["/opt/zeek/logs/current/dpd.log"]
files:
enabled: true
var.paths: ["/opt/zeek/logs/current/files.log"]
ftp:
enabled: true
var.paths: ["/opt/zeek/logs/current/ftp.log"]
http:
enabled: true
var.paths: ["/opt/zeek/logs/current/http.log"]
intel:
enabled: true
var.paths: ["/opt/zeek/logs/current/intel.log"]
irc:
enabled: true
var.paths: ["/opt/zeek/logs/current/irc.log"]
kerberos:
enabled: true
var.paths: ["/opt/zeek/logs/current/kerberos.log"]
modbus:
enabled: true
var.paths: ["/opt/zeek/logs/current/modbus.log"]
mysql:
enabled: true
var.paths: ["/opt/zeek/logs/current/mysql.log"]
notice:
enabled: true
var.paths: ["/opt/zeek/logs/current/notice.log"]
ntlm:
enabled: true
var.paths: ["/opt/zeek/logs/current/ntlm.log"]
#ntls:
#enabled: true
#var.paths: ["/opt/zeek/logs/current/ntls.log"]
ntp:
enabled: true
var.paths: ["/opt/zeek/logs/current/ntp.log"]
ocsp:
enabled: true
var.paths: ["/opt/zeek/logs/current/ocsp.log"]
pe:
enabled: true
var.paths: ["/opt/zeek/logs/current/pe.log"]
radius:
enabled: true
var.paths: ["/opt/zeek/logs/current/radius.log"]
rdp:
enabled: true
var.paths: ["/opt/zeek/logs/current/rdp.log"]
rfb:
enabled: true
var.paths: ["/opt/zeek/logs/current/rfb.log"]
signature:
enabled: true
var.paths: ["/opt/zeek/logs/current/signature.log"]
sip:
enabled: true
var.paths: ["/opt/zeek/logs/current/sip.log"]
smb_cmd:
enabled: true
var.paths: ["/opt/zeek/logs/current/smb_cmd.log"]
smb_files:
enabled: true
var.paths: ["/opt/zeek/logs/current/smb_files.log"]
smb_mapping:
enabled: true
var.paths: ["/opt/zeek/logs/current/smb_mapping.log"]
smtp:
enabled: true
var.paths: ["/opt/zeek/logs/current/smtp.log"]
snmp:
enabled: true
var.paths: ["/opt/zeek/logs/current/snmp.log"]
socks:
enabled: true
var.paths: ["/opt/zeek/logs/current/socks.log"]
software:
enabled: true
var.paths: ["/opt/zeek/logs/current/software.log"]
ssh:
enabled: true
var.paths: ["/opt/zeek/logs/current/ssh.log"]
ssl:
enabled: true
var.paths: ["/opt/zeek/logs/current/ssl.log"]
stats:
enabled: true
var.paths: ["/opt/zeek/logs/current/stats.log"]
syslog:
enabled: true
var.paths: ["/opt/zeek/logs/current/syslog.log"]
traceroute:
enabled: true
var.paths: ["/opt/zeek/logs/current/traceroute.log"]
tunnel:
enabled: true
var.paths: ["/opt/zeek/logs/current/tunnel.log"]
weird:
enabled: true
var.paths: ["/opt/zeek/logs/current/weird.log"]
x509:
enabled: true
var.paths: ["/opt/zeek/logs/current/x509.log"]
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [June 6, 2022, 3:18pm UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/9 "2022-06-06T15:18:49Z")
> [@Chandrapaul](#):
>
> ```auto
> software:
> enabled: true
> var.paths: ["/opt/zeek/logs/current/software.log"]
>
> ```
as @legoguy1000 that is not a valid fileset you need to remove that.
If you want to collect those logs you will need to set up a regular [filestream input.](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 4, 2022, 5:18pm UTC](https://discuss.elastic.co/t/unable-to-load-software-log-into-elasticsearch/306309/10 "2022-07-04T17:18:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.