# Zeek Filebeat Module - index is not populated

**URL:** <https://discuss.elastic.co/t/zeek-filebeat-module-index-is-not-populated/244430>\
**Category:** Beats\
**Tags:** beats-module, filebeat\
**Created:** [August 10, 2020, 3:20pm UTC](https://discuss.elastic.co/t/zeek-filebeat-module-index-is-not-populated/244430 "2020-08-10T15:20:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ommneom](https://avatars.discourse-cdn.com/v4/letter/o/85f322/32.png) [@ommneom](https://discuss.elastic.co/u/ommneom)\
**Post date:** [August 10, 2020, 3:20pm UTC](https://discuss.elastic.co/t/zeek-filebeat-module-index-is-not-populated/244430/1 "2020-08-10T15:20:29Z")

</div>

Hello,

I'm having trouble with what seems like a standard scenario and I can't figure out what I'm doing wrong.

**The setup :** I installed Elasticsearch and Kibana (version 7.8.1 for both) on the same server. I kept the configuration files for these 2 almost untouched, the only changes were (in this scenario, 192.168.10.5 is the IP address of the server) :

_elasticsearch.yml_ :

```auto
network.host: [127.0.0.1,192.168.10.5]
node.name: es-node
cluster.initial_master_nodes: ["es-node"]

```

_kibana.yml_ :

```auto
 server.host: "192.168.10.5"

```

Elasticsearch and Kibana are both installed on a CentOS 8 (64-bit) server. To make sure that it wouldn't cause a problem, I disabled the "firewalld" service and SELinux (by setting the right option in /etc/selinux/config and then restarting the server)

I have another server (Debian 10) with Zeek 3.1.5 installed on it. Both servers are connected to the same switch and have IPs on the same subnet (192.168.10.0/24)

**What I'm trying to do :** I want to use the Zeek module for Filebeat and use the Kibana dashboards.

**The problem :** On the Zeek server, I installed Filebeat via apt (version 7.8.1), I set the configuration like this :

```auto
output.elasticsearch:
  hosts: ["192.168.10.5:9200"]
setup.kibana:
  host: "192.168.10.5:5601"

```

I then enabled the Zeek Filebeat module and then I entered :

```auto
filebeat setup

```

There were no errors in the returned output :

```auto
Overwriting ILM policy is disabled. Set `setup.ilm.overwrite:true` for enabling.

Index setup finished.
Loading dashboards (Kibana must be running and reachable)
Loaded dashboards
Setting up ML using setup --machine-learning is going to be removed in 8.0.0. Please use the ML app instead.
See more: https://www.elastic.co/guide/en/elastic-stack-overview/current/xpack-ml.html
Loaded machine learning job configurations
Loaded Ingest pipelines

```

However, when I look at the "filebeat-\*" index in the "Discover" tab of Kibana it is never populated.

And when I try to look at the Zeek pre-made dashboard, I get a lot of these errors :

 ![2020-08-10 14_19_20-Window](https://us1.discourse-cdn.com/elastic/original/3X/2/a/2a74527761ebffa7a9dee0df79c805a4f260552e.png)

I have another server (Debian 10) on the same subnet (same switch). I installed Auditbeat on it, edited the auditbeat.yml file and then run the setup command. The auditbeat-\* index was successfully created and is populated (I don't know what it implies but I thought it could be relevant information)

**What I tried so far** :  
From what I could find on these forums, I thought it might be an XPack problem, so I disabled all the XPack features in elasticsearch.yml. It didn't change anything.

I found a post in the Kibana forums which suggested that since the Zeek module had been created for Zeek 2.6.1, maybe using a version newer than 3.0.0 was the source of the problem.

I uninstalled Zeek from the Debian server and reinstalled Bro 2.6.1 (at version 2.6.1, Zeek was named Bro), I restarted Filebeat and rerun the setup command. This didn't change anything.

I thought that maybe the fact that Bro was installed in another path could still be a problem, so I edited the /etc/filebeat/modules.d/zeek.yml to add this line :

```auto
var.paths: /usr/local/bro/logs/current/*.log

```

I then restarted Filebeat and rerun the setup command. It didn't change anything.

Can you help me figure out what I did wrong and how I can further troubleshoot this issue ?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 7, 2020, 5:20pm UTC](https://discuss.elastic.co/t/zeek-filebeat-module-index-is-not-populated/244430/2 "2020-09-07T17:20:31Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.