Advanced settings

Behind the scenes, each module starts a Filebeat prospector. Advanced users can add or override any prospector settings. For example, you can set close_eof to true in the module configuration:

- module: nginx
  access:
    prospector:
      close_eof: true

Or at the command line like this:

./filebeat -M "nginx.access.prospector.close_eof=true"

Here you see how to use the -M flag along with the --modules flag:

./filebeat --modules nginx -M "nginx.access.prospector.close_eof=true"

You can use wildcards to change variables or settings for multiple modules/filesets at once. For example, the following command enables close_eof for all the filesets in the nginx module:

./filebeat -M "nginx.*.prospector.close_eof=true"

The following command enables close_eof for all prospectors created by any of the modules:

./filebeat -M "*.*.prospector.close_eof=true"