Override input settings

Behind the scenes, each module starts a Filebeat input. Advanced users can add or override any input settings. For example, you can set close_eof to true in the module configuration:

- module: nginx
  access:
    input:
      close_eof: true

Or at the command line when you run Filebeat:

-M "nginx.access.input.close_eof=true"

You can use wildcards to change variables or settings for multiple modules/filesets at once. For example, you can enable close_eof for all the filesets in the nginx module:

-M "nginx.*.input.close_eof=true"

You can also enable close_eof for all inputs created by any of the modules:

-M "*.*.input.close_eof=true"