# Creating custom filebeat module

**URL:** <https://discuss.elastic.co/t/creating-custom-filebeat-module/162956>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 4, 2019, 12:32pm UTC](https://discuss.elastic.co/t/creating-custom-filebeat-module/162956 "2019-01-04T12:32:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ep4sh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ep4sh/32/40099_2.png) [@ep4sh](https://discuss.elastic.co/u/ep4sh)\
**Post date:** [January 4, 2019, 12:32pm UTC](https://discuss.elastic.co/t/creating-custom-filebeat-module/162956/1 "2019-01-04T12:32:48Z")

</div>

Okay, i read [https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html](https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html)  
And i almost have done:

```auto
mkdir -p ${GOPATH}/src/github.com/elastic
cd ${GOPATH}/src/github.com/elastic
git clone https://github.com/elastic/beats.git
make create-module MODULE=p5sh
make create-fileset MODULE=p5sh FILESET=p5shset

```

After i create **pipeline**  
Then:

```auto
make create-fields
make update

```

What next? How can i enable new module with my system? Documentation breaks off on `make update` and `test` 😕

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [January 4, 2019, 4:04pm UTC](https://discuss.elastic.co/t/creating-custom-filebeat-module/162956/2 "2019-01-04T16:04:12Z")

</div>

Hey @ep4sh,

I've created a few modules for our Filebeat, albeit I haven't actually used any of the Makefile's to do so, however from what I can see they just help scaffold the relevant file structure.

It sounds like you have your module configured and the structure probably looks like the below?

```auto
module/{module}
├── module.yml
└── _meta
    └── docs.asciidoc
    └── fields.yml
    └── kibana

```

If this is the case you should just need to enable that module when you run Filebeat. There are a number of ways to do this outlined here: [https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-modules.html](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-modules.html)

You can verify the module is enabled by running `filebeat modules list`

---

<div class="post-metadata">

**Author:** ![ep4sh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ep4sh/32/40099_2.png) [@ep4sh](https://discuss.elastic.co/u/ep4sh)\
**Post date:** [January 9, 2019, 3:04pm UTC](https://discuss.elastic.co/t/creating-custom-filebeat-module/162956/3 "2019-01-09T15:04:26Z")

</div>

Thanks for your reply! I have some comments to my Q.

I have installed services of **filebeat** on every machine ( **debian 9** + **filebeat.service** installed **from .deb file** ).

Now i should to add my custom module  
I have configured it (look my mess #1) and build  
Also i found, that module i built founded in:

> $GOPATH/src/github.com/elastic/beats/filebeat/build/module/p5sh

Yes, it has the same structure, like in your post.

But also i know that system modules are founded in:

> /usr/share/filebeat/module/\*

So when i do `sudo filebeat modules list` - **i dont see** my custom module.

**Question:**  
How can correct to deploy my custom module?  
Copy from `$GOPATH/src/github.com/elastic/beats/filebeat/build/module/p5sh`? Or what?  
It`s unclear for me and it is missing in doc. Thanks for yours reply.

* * *

**UPD**. I tried with standalone _filebeat_ from `.tar.gz`, copied into `modules` directory my **custom** module - **it works fine**.

But when i copy to `/usr/share/filebeat/module` - it **doesnt** work.

---

<div class="post-metadata">

**Author:** ![Evesy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/evesy/32/29520_2.png) [@Evesy](https://discuss.elastic.co/u/Evesy)\
**Post date:** [January 10, 2019, 10:56am UTC](https://discuss.elastic.co/t/creating-custom-filebeat-module/162956/4 "2019-01-10T10:56:43Z")

</div>

Copying into `/usr/share/filebeat/module` is what I'm familiar with. Inside that directory I have something like the below:

```auto
ingress-nginx/
|-- _meta
| |-- config.yml
| `-- fields.yml
|-- access
| |-- config
| | `-- access.yml
| |-- ingest
| | `-- pipeline.json
| `-- manifest.yml
`-- error
    |-- config
    | `-- error.yml
    |-- ingest
    | `-- pipeline.json
    `-- manifest.yml

```

In addition to that, within `/usr/share/filebeat/modules.d/` I have corresponding files to enable the module:

```auto
$ cat ingress-nginx.yml
- module: ingress-nginx
  access:
    enabled: true
  error:
    enabled: true

```

You don't have the `filebeat.config.modules`config option set pointing at the incorrect location by any chance?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 7, 2019, 10:56am UTC](https://discuss.elastic.co/t/creating-custom-filebeat-module/162956/5 "2019-02-07T10:56:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.