Specify which modules to run

Filebeat modules provide a quick way for you to get started processing common log formats. They contain default configurations, Elasticsearch ingest node pipeline definitions, and Kibana dashboards to help you implement and deploy a log monitoring solution.

Filebeat provides a few different ways to enable modules. You can:

When you enable modules, you can also specify variable settings to change the default behavior of the modules, and you can specify advanced settings to override input settings.

Before running Filebeat with modules enabled, make sure you also set up the environment to use Kibana dashboards. See Quick start: modules for common log formats for more information.

The modules.d directory contains default configurations for all the modules available in Filebeat. You can enable or disable specific module configurations under modules.d by running the modules enable or modules disable commands.

For example, to enable the apache and mysql configs in the modules.d directory, you use:

deb and rpm:

filebeat modules enable apache mysql

mac:

./filebeat modules enable apache mysql

brew:

filebeat modules enable apache mysql

linux:

./filebeat modules enable apache mysql

win:

PS > .\filebeat.exe modules enable apache mysql

Then when you run Filebeat, it loads the corresponding module configurations specified in the modules.d directory (for example, modules.d/apache.yml and modules.d/mysql.yml).

To see a list of enabled and disabled modules, run:

deb and rpm:

filebeat modules list

mac:

./filebeat modules list

brew:

filebeat modules list

linux:

./filebeat modules list

win:

PS > .\filebeat.exe modules list

The default module configurations assume that the logs you’re harvesting are in the location expected for your OS and that the behavior of the module is appropriate for your environment. To change the default configurations, you need to specify variable settings.

To enable specific modules when you run Filebeat at the command line, you can use the --modules flag. This approach works well when you’re getting started and want to specify different modules and settings each time you run Filebeat. Any modules specified at the command line will be loaded along with any modules that are enabled in the configuration file or modules.d directory. If there’s a conflict, the configuration specified at the command line is used.

The following command enables and runs the nginx,mysql, and system modules.

deb and rpm:

filebeat --modules nginx,mysql,system

mac:

./filebeat --modules nginx,mysql,system

win:

PS > .\filebeat.exe --modules nginx,mysql,system

The default module configurations assume that the logs you’re harvesting are in the location expected for your OS and that the behavior of the module is appropriate for your environment. To change the default configurations, you need to specify variable settings.

When possible, you should use the config files in the modules.d directory.

However, enabling modules directly in the config file is a practical approach if you have upgraded from a previous version of Filebeat and don’t want to move your module configs to the modules.d directory. You can continue to configure modules in the filebeat.yml file, but you won’t be able to use the modules command to enable and disable configurations because the command requires the modules.d layout.

To enable specific modules in the filebeat.yml config file, you can add entries to the filebeat.modules list. Each entry in the list begins with a dash (-) and is followed by settings for that module.

The following example shows a configuration that runs the nginx,mysql, and system modules.

filebeat.modules:
- module: nginx
- module: mysql
- module: system

The default module configurations assume that the logs you’re harvesting are in the location expected for your OS and that the behavior of the module is appropriate for your environment. To change the default configurations, you need to specify variable settings.