# Different modules?

**URL:** <https://discuss.elastic.co/t/different-modules/255345>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [November 13, 2020, 1:12pm UTC](https://discuss.elastic.co/t/different-modules/255345 "2020-11-13T13:12:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![MichaelJ](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@MichaelJ](https://discuss.elastic.co/u/MichaelJ)\
**Post date:** [November 13, 2020, 1:12pm UTC](https://discuss.elastic.co/t/different-modules/255345/1 "2020-11-13T13:12:49Z")

</div>

We're using filebeat to ingest all kinds of logfiles: application logs, apache, nginx, whatever.

For specifix log files, like apache, we want to parse the message into different fields. The apache module with its ingest node pipeline seems to be the correct way.

But we don't want to apply this pipeline to ALL messages, only to apache logs. Is there a way to define how to apply which module to which log file?

---

<div class="post-metadata">

**Author:** ![abrx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abrx/32/43881_2.png) [@abrx](https://discuss.elastic.co/u/abrx)\
**Post date:** [November 13, 2020, 2:36pm UTC](https://discuss.elastic.co/t/different-modules/255345/2 "2020-11-13T14:36:25Z")

</div>

According to the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-apache.html#configuring-apache-module), you have to specify the paths monitored by the module (in module dedicated config file), so it should work in parallel with your classic input defined in the dedicated file.

---

<div class="post-metadata">

**Author:** ![MichaelJ](https://avatars.discourse-cdn.com/v4/letter/m/7c8e57/32.png) [@MichaelJ](https://discuss.elastic.co/u/MichaelJ)\
**Post date:** [November 13, 2020, 2:42pm UTC](https://discuss.elastic.co/t/different-modules/255345/3 "2020-11-13T14:42:24Z")

</div>

As far as I understand, modules are a combination of  
a) default input configuration (covered by the paths monitored)  
b) ingest node pipelines  
c) Kibana dashboards.

Ingest node pipelines are in elasticsearch. I can list them at http://:9200/\_ingest/pipeline  
But they seem to be globally? Or does Filebeat select pipelines conditionally during ingest? How can I confirm that?

---

<div class="post-metadata">

**Author:** ![abrx](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abrx/32/43881_2.png) [@abrx](https://discuss.elastic.co/u/abrx)\
**Post date:** [November 13, 2020, 2:48pm UTC](https://discuss.elastic.co/t/different-modules/255345/4 "2020-11-13T14:48:15Z")

</div>

Well try to run both module and config file and count the number of filebeat process, this should indicate if they are separated or not.  
The module will use his default ingest pipeline but in normal configuration you can select another target in [output](https://www.elastic.co/guide/en/beats/filebeat/current/elasticsearch-output.html), aka index pattern or pipeline id.  
Didn't try that in filebeat but worked few years ago with logstash standard pipeline + netflow module.  
Please tell me if you find out 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2020, 4:48pm UTC](https://discuss.elastic.co/t/different-modules/255345/5 "2020-12-11T16:48:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.