WARNING: Version 6.2 of Filebeat has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Specify general settings Live reloading »
Elastic Docs ›Filebeat Reference [6.2] ›Configuring Filebeat

Load external configuration files

edit

Load external configuration files

edit

Filebeat can load external configuration files for prospectors and modules, which allows you to separate your configuration into multiple smaller configuration files. See the Prospector config and the Module config sections for details.

On systems with POSIX file permissions, all Beats configuration files are subject to ownership and file permission checks. For more information, see Config File Ownership and Permissions in the Beats Platform Reference.

Prospector config

edit

For prospector configurations, you specify the path option in the filebeat.config.prospectors section of the filebeat.yml file. For example:

filebeat.config.prospectors:
  enabled: true
  path: configs/*.yml

Each file found by the path Glob must contain a list of one or more prospector definitions.

The first line of each external configuration file must be a prospector definition that starts with - type. Make sure you omit the line filebeat.config.prospectors from this file.

For example:

- type: log
  paths:
    - /var/log/mysql.log
  scan_frequency: 10s

- type: log
  paths:
    - /var/log/apache.log
  scan_frequency: 5s

It is critical that two running prospectors DO NOT have overlapping file paths defined. If more than one prospector harvests the same file at the same time, it can lead to unexpected behavior.

Module config

edit

For module configurations, you specify the path option in the filebeat.config.modules section of the filebeat.yml file. By default, Filebeat loads the module configurations enabled in the modules.d directory. For example:

filebeat.config.modules:
  enabled: true
  path: ${path.config}/modules.d/*.yml

The path setting must point to the modules.d directory if you want to use the modules command to enable and disable module configurations.

Each file found by the Glob must contain a list of one or more module definitions.

The first line of each external configuration file must be a module definition that starts with - module. Make sure you omit the line filebeat.config.modules from this file.

For example:

- module: apache2
  access:
    enabled: true
    var.paths: [/var/log/apache2/access.log*]
  error:
    enabled: true
    var.paths: [/var/log/apache2/error.log*]
« Specify general settings Live reloading »