I just tried to start a Filebeat system module on the Mac the first time (5.5 BC6 build) using 5.5 docs: https://www.elastic.co/guide/en/beats/filebeat/5.5/filebeat-module-system.html

A couple of snags:

• We refer to the "syslog" module, whereas the module name is now "syslog"
• More worryingly, in the product itself the Filebeat system dashboard is still called the "syslog" dashboard (cc @monicasarbu ), which is confusing IMO
• Docs don't mention that ingest-geoip plugin in ES is required (the way they do in Apache2), but on startup I got an error when that wasn't installed
• When I tried to run sudo ./filebeat -e -modules=system -setup, I got file ownership errors around -- not sure if this was because I was using the BC or because i'm starting up the module using "sudo":

-> Run {filebeat}$ sudo chown root filebeat.yml 
-> Run {filebeat}$ sudo chown root /module/system/auth/manifest.yml 
-> Run {filebeat}$ sudo chown root /module/system/syslog/manifest.yml 
-> Run {filebeat}$ sudo ./filebeat -e -modules=system -setup

-> Run {filebeat}$ sudo chown root filebeat.yml 
-> Run {filebeat}$ sudo chown root module/apache2/access/manifest.yml 
-> Run {filebeat}$ sudo chown root module/apache2/error/manifest.yml 
-> Run {filebeat}$ sudo ./filebeat -e -modules=apache2 -setup

-> Run {filebeat}$ sudo chown root filebeat.yml 
-> Run {filebeat}$ sudo chown root module/nginx/access/manifest.yml 
-> Run {filebeat}$ sudo chown root module/nginx/error/manifest.yml 
-> Run {filebeat}$ sudo ./filebeat -e -modules=nginx -setup

-> Run {filebeat}$ sudo chown root filebeat.yml 
-> Run {filebeat}$ sudo chown root module/mysql/slowlog/manifest.yml 
-> Run {filebeat}$ sudo chown root module/mysql/error/manifest.yml 
-> Run {filebeat}$ sudo ./filebeat -e -modules=mysql -setup

• Following onto that point, it’s confusing to me why instructions for running modules don’t use “sudo” and instructions for running filebeat w.o modules do -- was that intentional?
  https://www.elastic.co/guide/en/beats/filebeat/5.5/_tutorial.html
  https://www.elastic.co/guide/en/beats/filebeat/5.5/filebeat-starting.html
• I didn't see any data in the Last 15 minutes, so I thought things were broken. Brandon informed me that I may need to change range to Last 24 Hours to see system data, and indeed I see data from now (Tue Jun 27 10:10:27 PDT 2017) recorded as 2017/06/27 17:10:26.884147. This behaviour is different from Metricbdeat, is that expected? If so, should that time range just be saved with the dashboard by default?