Creating a filebeat module

[elasticfran (fran)]

Hey there!

I am trying to write a custom filebeat module, which are the proper guidelines to follow ?

Found Creating a New Beat | Beats Developer Guide [7.12] | Elastic which i find pretty comprehensive but i wonder whether there s another way to do it coz i cant use golang.

Thanks in advance

[bertr (Bert Rietveld)]

As far as I know you have to use golang unless you really want to mimic everything that you get 'for free' (e.g. config file processing, output processing, parallel processing etc etc) in another comprehensive language. My advice: don't even think about it, learning golang is a lot easier than you think (it's just another programming language) and definitely a lot easier then rewriting everything in any other language.

Just my two cents

[legoguy1000 (Alex)]

If u just want to create a new module for filebeat, u don't need to know any Golang. Just yaml files in the correct location. If u want to make a custom Beat, then yes it's all Golang.

[elasticfran (fran)]

Yes, would be a new module for filebeat ! Is there an official procedure for the yaml files? THANKS

[legoguy1000 (Alex)]

See Creating a New Filebeat Module | Beats Developer Guide [master] | Elastic

[elasticfran (fran)]

Thanks.

If i run the command make create-module MODULE=xyz i get:

Assume it s related to Go which i dont have and can t have on my system

[legoguy1000 (Alex)]

If u can't have Golang installed on your system, if u have Filebeat installed already u can manually add the Yaml files for the module/filesets in like /usr/lib/filebeat... or something like that.