Configuring Input Type for Filebeat Module

Elastic Stack Beats
1

Hello! Is there a way to add configuration options to the lower-level input type that a filebeat module uses? For instance, if I am using the zeek filebeat module and I want to change some of the default settings for the log input, such as close_renamed, close_inactive, ignore_older, etc., is there a way to do this from the module configuration? I haven't found a way yet through the online documentation and it doesn't seem possible from looking through the source code.

Thanks!

2

It is possible by providing input level config under input keyword.

Example using the system module:

 #==========================  Modules configuration =============================
 filebeat.modules:
 - module: system
   # Syslog
   syslog:
     enabled: true

     # Input configuration (advanced). Any input configuration option
     # can be added under this section.
     input:
       close_renamed: true
1 Like
3

Fantastic! I'll give that a shot, thank you.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.