# \[Filebeat\] Changing filebeat's path for it's configuration module

**URL:** <https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [June 8, 2020, 10:52pm UTC](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243 "2020-06-08T22:52:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gonzalo2kx](https://avatars.discourse-cdn.com/v4/letter/g/c4cdca/32.png) [@gonzalo2kx](https://discuss.elastic.co/u/gonzalo2kx)\
**Post date:** [June 8, 2020, 10:52pm UTC](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243/1 "2020-06-08T22:52:33Z")

</div>

Good day,

I am currently experiencing a problem to load the system module on filebeat. The system module has been enabled and verified using "filebeat modules list". When I launch filebeat 7.6.2 in publish mode I get the following error:

```auto
"Not loading modules. Module directory not found: /usr/share/filebeat/bin/module"

```

During launch time, the first line I get is the following:

```auto
2020-06-08T17:34:49.831-0500	INFO	instance/beat.go:622	Home path: [/usr/share/filebeat/bin] Config path: [/usr/share/filebeat/bin] Data path: [/usr/share/filebeat/bin/data] Logs path: [/usr/share/filebeat/bin/logs]

```

As far as I understand, whenever we enable a module within filebeat, the suffix from the file "system.yml.disabled" changes to "system.yml". I have validated this but contrary from where filebeat expect to observe this file " /usr/share/filebeat/bin/module" , all module yml files are actually located in "/etc/filebeat/modules.d/".

I used two methods in my attempt to fix this issue:

1. Enable and change the module's configuration path in "/etc/filebeat/filebeat.yml":

```auto
filebeat.config.modules:
  enabled: true
  path: /etc/filebeat/modules.d/*.yml

```

1. Change the configuration path at the start of filebeat's configuration path in "/etc/filebeat/filebeat.yml" by stating:

```auto
path.config: /etc/filebeat

```

Followed by stating the module's configuration path as follows:

```auto
filebeat.config.modules:
  enabled: true
  path: ${path.config}/modules.d/*.yml

```

This resulted in the following Config path change on runtime:

```auto
2020-06-08T17:49:34.832-0500	INFO	instance/beat.go:622	Home path: [/usr/share/filebeat/bin] Config path: [/etc/filebeat] Data path: [/usr/share/filebeat/bin/data] Logs path: [/usr/share/filebeat/bin/logs]

```

Both approaches resulted in the same error presented below. Tried to restart the system to see any difference but no luck.

```auto
2020-06-08T17:49:35.879-0500	ERROR	fileset/modules.go:125	Not loading modules. Module directory not found: /usr/share/filebeat/bin/module

```

Please help

---

<div class="post-metadata">

**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\
**Post date:** [June 9, 2020, 9:40am UTC](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243/2 "2020-06-09T09:40:26Z")

</div>

Hi!

How exactly do you install Filebeat?

Did you try to follow exactly the process that is described in the docs ([https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html)) and check if works?

C.

---

<div class="post-metadata">

**Author:** ![gonzalo2kx](https://avatars.discourse-cdn.com/v4/letter/g/c4cdca/32.png) [@gonzalo2kx](https://discuss.elastic.co/u/gonzalo2kx)\
**Post date:** [June 26, 2020, 7:56pm UTC](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243/3 "2020-06-26T19:56:22Z")

</div>

Good day @ChrsMark,

I followed the installation. I figured out that the path.home was set to "/usr/share/filebeat/bin/" instead of "/usr/share/filebeat/" where the "module" directory could be found. I fixed this issue by setting the paths in filebeat's configuration file "/etc/filebeat/filebeat.yml" right after the first comments in the document.

> path.home : /usr/share/filebeat  
> path.config : /etc/filebeat  
> path.data : /var/lib/filebeat  
> path.logs : /var/log/filebeat

I installed filebeat using the following commands:

```auto
curl -L -O https://artifacts.elastic.co/downloads/beats/filebeat/filebeat-7.7.1-amd64.deb
sudo dpkg -i filebeat-7.7.1-amd64.deb

```

This seems to be a bug that in some installations appears and in some others disappears even when using the sam cloud image.

Another issue I have encountered is that the modules configuration path is changed from "/etc/filebeat". Therefore, to solve this issue I need to set "path.config : /etc/filebeat", as stated on the comments above, along with the following changes in filebeat's configuration:

From this configuration:

```auto
filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

```

To the following specific path:

```auto
filebeat.config.modules:
  path : /etc/filebeat/modules.d/*.yml

```

I hope this helps other users going through the same struggles. This has been a recurring issue that has not been properly addressed.

Notes:

1. The directory "/etc/filebeat/modules.d/" contains a list of yml files that state which modules are enabled and disabled in filebeat.
2. The directory "/usr/share/filebeat/module/" contains subdirectories named after each available module (enabled or disabled). Each subdirectory contains the following:  
a) A file named "module.yml" presenting a list of dashboards associated to the module and the corresponding IDs  
b) A set of sub-sub-directories associated with the fileset/dataset of the corresponding module (e.g, auth and syslog for the system module). Each of these contain 3 additional yml files; one for configuration, one to set the pipeline when connecting filebeat directly to elasticsearch, and one manifest file.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 24, 2020, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243/4 "2020-07-24T21:56:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.