Dynamically update filebeat filebeat.yml file

Hello guys kindly take a look at this question on https://stackoverflow.com/questions/51854887/dynamically-update-filebeat-config-yml-file

Have you tried using the reload functionality of Filebeat? https://www.elastic.co/guide/en/beats/filebeat/current/_live_reloading.html

I assume your application retrieves paths from users and you would like to add it to filebeat.yml to start reading from the paths. Please, correct me if I am wrong.
If that's the case I think you need live reloading. You can either create one external configuration file with one input which reads all files added by users. When a user submits a new path, you could add the new path to the external config file. Then Filebeat detects the change and restarts.
The other option you have is adding a new input every time a new path is submitted by creating a new external config file under the configured directory (configs dir in the example config).

filebeat.config.inputs:
  enabled: true
  path: configs/*.yml
  reload.enabled: true
  reload.period: 10s

Hello i can't seem to find the filebeat.config.inputs: in the filebeat.yml file. Is it the same as filebeat.config.module ?

Also for the part that points to configs folder

e.g of sample file i created a file in modules.d folder and called it input.yml

Content below

paths:
    - C:\Users\debayo\Desktop\WWWLOGs\W3SVC6\*.log
    - C:\Users\debayo\Desktop\WWWLOGs\*\*.log
    - C:\Users\debayo\Documents\LOGs\*.log

Pardon my many questions if they don't seem to make sense i'm new to the stack generally.

I altered it and it still doesn't seem to work

Hey Guys thank you very much, resolved the issue guess sometimes lots of patience and trial is required in reading the docs.

Thanks for pointing me in the right direction.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.