IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Step 2: Connect to Elasticsearch and Kibana Step 4: Set up assets »
Elastic Docs ›Observability Guide [7.9] ›Send data to Elasticsearch ›Ingest logs

Step 3: Enable and configure modules

edit

Step 3: Enable and configure modules

edit

Filebeat uses modules to collect and parse log data.

  1. Identify the modules you need to enable. To see a list of available modules, run:

    filebeat modules list

    Can’t find a module for your file type? Skip this section and configure the input manually.

  2. From the installation directory, enable one or more modules. For example, the following command enables the system, nginx, and mysql module configs:

    filebeat modules enable system nginx mysql

  3. In the module configs under modules.d, change the module settings to match your environment.

    For example, log locations are set based on the OS. If your logs aren’t in default locations, set the paths variable:

    - module: nginx
  access:
    var.paths: ["/var/log/nginx/access.log*"]

To see the full list of variables for a module, see the documentation under Modules.

To test your configuration file, change to the directory where the Filebeat binary is installed, and run Filebeat in the foreground with the following options specified: ./filebeat test config -e. Make sure your config files are in the path expected by Filebeat (see Directory layout), or use the -c flag to specify the path to the config file.

For more information about configuring Filebeat, also see:

« Step 2: Connect to Elasticsearch and Kibana Step 4: Set up assets »