diff --git a/manifests/module/system.pp b/manifests/module/system.pp
new file mode 100644
index 0000000..a75b9ab
--- /dev/null
+++ b/manifests/module/system.pp
@@ -0,0 +1,49 @@
+# filebeat::module::system
+#
+# @summary
+#   This class manages the Filebeat system module.
+#
+# @example
+#   class { 'filebeat::module::system':
+#     syslog_enabled => true,
+#     syslog_paths   => [
+#       '/var/log/syslog',
+#     ],
+#     auth_enabled   => true,
+#     auth_paths     => [
+#       '/var/log/auth.log',
+#     ],
+#   }
+#
+# @param syslog_enabled
+#   A boolean value to enable or disable the syslog module.
+# @param syslog_paths
+#   An optional array of paths to the syslog logs.
+# @param auth_enabled
+#   A boolean value to enable or disable the auth module.
+# @param auth_paths
+#   An optional array of paths to the auth logs.
+#
+class filebeat::module::system (
+  Boolean $syslog_enabled = false,
+  Optional[Array[Stdlib::Unixpath]] $syslog_paths = undef,
+  Boolean $auth_enabled = false,
+  Optional[Array[Stdlib::Unixpath]] $auth_paths = undef,
+) {
+  filebeat::module { 'system':
+    config => {
+      'syslog' => delete_undef_values(
+        {
+          'enabled'   => $syslog_enabled,
+          'var.paths' => $syslog_paths,
+        }
+      ),
+      'auth'   => delete_undef_values(
+        {
+          'enabled'   => $auth_enabled,
+          'var.paths' => $auth_paths,
+        }
+      ),
+    },
+  }
+}
diff --git a/spec/classes/module/system_spec.rb b/spec/classes/module/system_spec.rb
new file mode 100644
index 0000000..c52397f
--- /dev/null
+++ b/spec/classes/module/system_spec.rb
@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'filebeat::module::system' do
+  let :pre_condition do
+    'include ::filebeat'
+  end
+
+  let(:facts) { 
+    {
+      :kernel => 'Linux',
+      :os => {
+        :family => 'Debian',
+        :name => 'Ubuntu',
+      }
+    } 
+  }
+  
+  context 'on default values' do
+    it { is_expected.to compile.with_all_deps }
+
+    it {
+      is_expected.to contain_file('filebeat-module-system').with_content(
+      %r{- module: system\n\s{2}syslog:\n\s{4}enabled: false\n\s{2}auth:\n\s{4}enabled: false\n\n},
+    )}
+  end
+
+  context 'on log and slowlog enabled with paths' do
+    let(:params) do
+      {
+        'syslog_enabled' => true,
+        'syslog_paths' => ['/var/log/syslog'],
+        'auth_enabled' => true,
+        'auth_paths' => ['/var/log/auth.log'],
+      }
+    end
+
+    it { is_expected.to compile.with_all_deps }
+
+    it {
+      is_expected.to contain_file('filebeat-module-system').with_content(
+        <<-EOS
+### Filebeat configuration managed by Puppet ###
+---
+- module: system
+  syslog:
+    enabled: true
+    var.paths:
+    - "/var/log/syslog"
+  auth:
+    enabled: true
+    var.paths:
+    - "/var/log/auth.log"
+
+EOS
+    )
+    }
+  end
+end