› ›

Migrating from a Deprecated Filebeat Module

If a Filebeat module has been deprecated, there are a few options available for a path forward:

Migrate to an Elastic integration, if available. The deprecation notice will link to an appropriate integration, if one exists.
Migrate to Elastic Agent for ingesting logs. If a specific integration for the vendor/product does not exist, then one of the custom integrations can be used for ingesting events. A custom pipeline may also be attached to the integration for further processing.
- CEL Custom API - Collect events from an API using CEL (Common Expression Language)
- Custom API - Collect events from an API using the HTTPJSON input
- Custom Google Pub/Sub - Collect events from Google Pub/Sub topics
- Custom HTTP Endpoint - Collect events from a listening HTTP port
- Custom Journald - Collect events from journald
- Custom Kafka - Collect events from a Kafka topic
- Custom Logs - Collect events from files
- Custom TCP - Collect events from a listening TCP port
- Custom UDP - Collect events from a listening UDP port
- Custom Windows Event - Collect events from a Windows Event Log channel
Migrate to a different Filebeat module. In some cases, a Filebeat module may be superseded by a new module. The deprecation notice will link to an appropriate module, if one exists.
Use a custom Filebeat input, processors, and ingest pipeline (if necessary).