diff --git a/filebeat/module/system/auth/test/test.log-expected.json b/filebeat/module/system/auth/test/test.log-expected.json
index c593b6340e0..cb69ad804f0 100644
--- a/filebeat/module/system/auth/test/test.log-expected.json
+++ b/filebeat/module/system/auth/test/test.log-expected.json
@@ -115,6 +115,17 @@
         "system.auth.sudo.user": "root", 
         "user.name": "tsg"
     }, 
+    {
+        "@timestamp": "2018-02-22T11:47:05.000Z", 
+        "event.dataset": "auth", 
+        "event.module": "system", 
+        "host.hostname": "localhost", 
+        "input.type": "log", 
+        "log.offset": 861, 
+        "process.pid": 6991, 
+        "system.auth.groupadd.gid": 48, 
+        "system.auth.groupadd.name": "apache"
+    }, 
     {
         "@timestamp": "2018-02-22T11:47:05.000Z", 
         "event.dataset": "auth",