diff --git a/salt/filebeat/etc/filebeat.yml b/salt/filebeat/etc/filebeat.yml
index f0bbe3e11..342b925a0 100644
--- a/salt/filebeat/etc/filebeat.yml
+++ b/salt/filebeat/etc/filebeat.yml
@@ -37,7 +37,8 @@ filebeat.prospectors:
     clean_removed: false
     close_removed: false
 
-{%- if WAZUHENABLED != '1' %}
+{%- if WAZUHENABLED == '1' %}
+
   - type: log
     paths:
       - /wazuh/alerts/alerts.json