# Elastic Search Beat **URL:** \ **Category:** Beats\ **Created:** [April 14, 2016, 6:46pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427 "2016-04-14T18:46:13Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![GSL10019](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Post date:** [April 14, 2016, 6:46pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/1 "2016-04-14T18:46:13Z")
I was wondering how to customize the beats that are already available and how to direct the logs and what extremes can we customize the beats? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 15, 2016, 3:35am UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/2 "2016-04-15T03:35:46Z")
The documentation of each beat should describe how its behavior can be customized. ---
**Author:** ![GSL10019](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Post date:** [April 15, 2016, 1:51pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/3 "2016-04-15T13:51:06Z")
Oh okay, I just checked out some of the documentations and it does seem like a simple .confg file in each directories within the main beat program seem to be the solution. so would a document for a beat always be a .confg file? And I am assuming they would generally look like this? or Would each beat have a different format/file that much be applied? filebeat: prospectors: paths: -"C:\user\desktop" document\_type: apache exclude\_lines: ["teehee"] include\_lines:["^ERR","^WARN"] paths: -C:\user\desktop filebeat: config\_dir:C:\user And for this particular example, I am assuming it will be within the main filebeat path where the .yml,json,etc documents are. And thank you for the help =] ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 15, 2016, 1:54pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/4 "2016-04-15T13:54:12Z")
> so would a document for a beat always be a .confg file? I'm afraid I don't understand this question. > And I am assuming they would generally look like this? or Would each beat have a different format/file that much be applied? Yes, I believe all configuration files are in YAML format. That exact contents obviously depends on the Beat. > And for this particular example, I am assuming it will be within the main filebeat path where the .yml,json,etc documents are. You mean where the configuration file should be stored? I don't know the Windows conventions for that. I'd keep it out of the program's installation directory but technically you can put the file anywhere. ---
**Author:** ![GSL10019](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Post date:** [April 15, 2016, 2:00pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/5 "2016-04-15T14:00:27Z")
For the question about the .confg file, can a beat customizer document be of any type of file? or does it always have to consistently be a config document. Ahh i see that if i put the configuration file anywhere I just have to input config\_dir: pwd/ filebeat.config and do I have to specify the filebeat or can I just input .config and it would presumably scan all the configuration documents within the dir. And once again, much thanks and all the help is really awesome =] ---
**Author:** ![GSL10019](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Post date:** [April 15, 2016, 2:25pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/6 "2016-04-15T14:25:38Z")
Also, does everything have to be under prospectors or can they be a separate segment like registry\_files: and such ---
**Author:** ![GSL10019](https://avatars.discourse-cdn.com/v4/letter/g/ecb155/32.png) [@GSL10019](https://discuss.elastic.co/u/GSL10019)\ **Post date:** [April 15, 2016, 3:18pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/7 "2016-04-15T15:18:48Z")
Sorry for the pilling on questions, but in particular for filebeat, would i change this all within the yml and if I add that direct example would it theoretically look at all the apache files within that path with ^err and ^warn included lines? Much thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [April 18, 2016, 5:35pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/8 "2016-04-18T17:35:02Z")
> Sorry for the pilling on questions, but in particular for filebeat, would i change this all within the yml and if I add that direct example would it theoretically look at all the apache files within that path with ^err and ^warn included lines? I'm not sure exactly what you're asking but the answer is probably "yes". ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 9:53pm UTC](https://discuss.elastic.co/t/elastic-search-beat/47427/9 "2017-07-05T21:53:05Z")