Creating custom filebeat module

(Ep4sh) #1

Okay, i read
And i almost have done:

mkdir -p ${GOPATH}/src/
cd ${GOPATH}/src/
git clone
make create-module MODULE=p5sh
make create-fileset MODULE=p5sh FILESET=p5shset

After i create pipeline

make create-fields
make update

What next? How can i enable new module with my system? Documentation breaks off on make update and test :confused:

(Michael Eves) #2

Hey @ep4sh,

I've created a few modules for our Filebeat, albeit I haven't actually used any of the Makefile's to do so, however from what I can see they just help scaffold the relevant file structure.

It sounds like you have your module configured and the structure probably looks like the below?

├── module.yml
└── _meta
    └── docs.asciidoc
    └── fields.yml
    └── kibana

If this is the case you should just need to enable that module when you run Filebeat. There are a number of ways to do this outlined here:

You can verify the module is enabled by running filebeat modules list

(Ep4sh) #3

Thanks for your reply! I have some comments to my Q.

I have installed services of filebeat on every machine (debian 9 + filebeat.service installed from .deb file).

Now i should to add my custom module
I have configured it (look my mess #1) and build
Also i found, that module i built founded in:


Yes, it has the same structure, like in your post.

But also i know that system modules are founded in:


So when i do sudo filebeat modules list - i dont see my custom module.

How can correct to deploy my custom module?
Copy from $GOPATH/src/ Or what?
It`s unclear for me and it is missing in doc. Thanks for yours reply.

UPD. I tried with standalone filebeat from .tar.gz, copied into modules directory my custom module - it works fine.

But when i copy to /usr/share/filebeat/module - it doesnt work.

(Michael Eves) #4

Copying into /usr/share/filebeat/module is what I'm familiar with. Inside that directory I have something like the below:

|-- _meta
|   |-- config.yml
|   `-- fields.yml
|-- access
|   |-- config
|   |   `-- access.yml
|   |-- ingest
|   |   `-- pipeline.json
|   `-- manifest.yml
`-- error
    |-- config
    |   `-- error.yml
    |-- ingest
    |   `-- pipeline.json
    `-- manifest.yml

In addition to that, within /usr/share/filebeat/modules.d/ I have corresponding files to enable the module:

$ cat ingress-nginx.yml
- module: ingress-nginx
    enabled: true
    enabled: true

You don't have the filebeat.config.modulesconfig option set pointing at the incorrect location by any chance?

(system) closed #5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.