Filebeat data for system module is not available for Debian 12

[harshitgupta-qasource]

Kibana Build details:

VERSION: 9.0.0-beta1
BUILD: 83474
COMMIT: 88aa3d3604b2c71e998595c3208b3d82cef24d2a

Artifact Link: https://staging.elastic.co/9.0.0-beta1-191089b1/downloads/beats/filebeat/filebeat-9.0.0-beta1-amd64.deb

Preconditions:

1. 9.0.0 beta BC2 Kibana cloud environment should be available.

Steps to reproduce:

1. Update cloud id and cloud auth for Filebeat under filebeat.yml.
2. Now, enable system module using this command filebeat modules enable system.
3. Navigate to 'modules.d/system.yml' and set all false value to true.
4. Save the file.
5. Now run: filebeat setup -e for setup assests.
6. Observe Dashboards are successfully loaded.
7. Then start filebeat using this command sudo service filebeat start
8. Navigate to kibana > Discover Tab > Filebeat
9. Observe no data under Discover tab is displayed for Deb Agents.

Note:

• We were testing this beat with custom file path.
• Earlier, we have shared the same observation here: Datasets system.auth and system.syslog are not available for Debian 12 under Data streams tab. elastic-agent#3650 (comment)

Screenshot

[harshitgupta-qasource]

@amolnater-qasource Kindly review

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[amolnater-qasource]

Secondary review for this ticket is Done.
Related Issue: elastic/elastic-agent#3650

[VihasMakwana]

@harshitgupta-qasource @amolnater-qasource can you use var.use_journald: true for auth and system in your modules.d/system.yml config?

[harshitgupta-qasource]

HI @VihasMakwana

Thank you for the sharing the update.
As per your feedback, we have updated the system.yml file by var.use_journald: true for both auth and system. After making this change, we were able to view the data under the Discover tab.

Screenshot

• Discover Tab

Hence, we are closing this issue and marking this as QA: Validated
Thanks