# Filebeat configuration module path issue

**URL:** https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871
**Category:** Beats
**Tags:** filebeat
**Created:** [March 31, 2021, 6:50am UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871 "2021-03-31T06:50:11Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![tkkchan](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@tkkchan](https://discuss.elastic.co/u/tkkchan)
#### Post date: [March 31, 2021, 6:50am UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871/1 "2021-03-31T06:50:11Z")

</div>

Dear All,  
I am trying to follow [this](https://github.com/elastic/examples/tree/master/Exploring%20Public%20Datasets/earthquakes) tutorial here to build a dashboard on some public data sets.

However, whenever I tried to run ./filebeat, the following error appeared:

2021-03-31T14:19:44.685+0800 ERROR [modules] fileset/modules.go:131 Not loading modules. Module directory not found: /usr/share/filebeat/bin/module

And I have found this post here

> [@\[Filebeat\] Changing filebeat's path for it's configuration module](https://discuss.elastic.co/t/filebeat-changing-filebeats-path-for-its-configuration-module/236243/3):
>
> Good day @ChrsMark, I followed the installation. I figured out that the path.home was set to "/usr/share/filebeat/bin/" instead of "/usr/share/filebeat/" where the "module" directory could be found. I fixed this issue by setting the paths in filebeat's configuration file "/etc/filebeat/filebeat.yml" right after the first comments in the document. path.home : /usr/share/filebeat path.config : /etc/filebeat path.data : /var/lib/filebeat path.logs : /var/log/filebeat I installed filebeat us…

I see the same info popping up in the terminal, meaning that the path are not configured correctly.

2020-06-08T17:49:34.832-0500 INFO instance/beat.go:622 Home path: [/usr/share/filebeat/bin] Config path: [/etc/filebeat] Data path: [/usr/share/filebeat/bin/data] Logs path: [/usr/share/filebeat/bin/logs]

I tried modifying /etc/filebeat/filebeat.yml as stated in here, but it doesn't work.

Then I noted that there's some customized configuration in this example data set(you need to move a custom .yml (ncedc-earthquakes-filebeat.yml) to the /usr/share/filebeat/ directory). Then I tried to add the above configuration to this

```
    filebeat.inputs:

    # - /var/log/*.log

    # - /usr/share/filebeat
    # - /etc/filebeat
    # - /var/lib/filebeat
    # - /var/log/filebeat 

```

The following error occured:  
Exiting: error loading config file: yaml: line 11: found character that cannot start any token

I am not sure what I did wrong with adding the config, as I am not sure how to do it as well. Any help would be appreciated, thank you 😃

(If it helps: my version of ELK is as follows, all installed with RPM on a Centos 7)  
Elasticsearch, Logstash, Kibana: 7.11.2  
Filebeat: 7.12.0

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [March 31, 2021, 2:56pm UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871/2 "2021-03-31T14:56:33Z")

</div>

Hi @tkkchan, welcome to discuss 🙂

By default filebeat uses the current directory as home path, it seems that you are running filebeat as `./filebeat` from the `/usr/share/filebeat/bin` directory, and then it considers this directory its home path.

When installing using RPM or Debian packages a wrapper is installed in one of the default paths (in `/usr/bin/filebeat`). This wrapper includes flags to setup the proper paths:

```auto
#!/usr/bin/env bash

# Script to run Filebeat in foreground with the same path settings that
# the init script / systemd unit file would do.

exec /usr/share/filebeat/bin/filebeat \
  --path.home /usr/share/filebeat \
  --path.config /etc/filebeat \
  --path.data /var/lib/filebeat \
  --path.logs /var/log/filebeat \
  "$@"

```

In summary, try running filebeat without `./`, so the wrapper is used. Alternatively, run filebeat with custom paths.

Also take into account that the tutorial you are following is created for Filebeat 6.0, you may find some differences with more recent versions.

---

<div class="post-metadata">

### Author: ![tkkchan](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@tkkchan](https://discuss.elastic.co/u/tkkchan)
#### Post date: [April 1, 2021, 9:13am UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871/3 "2021-04-01T09:13:50Z")

</div>

Thank you very much for the prompt reply, Jamie. I figured it out as it was some other problem, but still, thank you very much for your help! 🙂

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [April 1, 2021, 9:42am UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871/4 "2021-04-01T09:42:28Z")

</div>

@tkkchan could you share your solution in case it helps others in the future? 🙂 Thanks!

---

<div class="post-metadata">

### Author: ![tkkchan](https://avatars.discourse-cdn.com/v4/letter/t/8491ac/32.png) [@tkkchan](https://discuss.elastic.co/u/tkkchan)
#### Post date: [April 7, 2021, 2:16pm UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871/5 "2021-04-07T14:16:11Z")

</div>

Dear Jamie,  
I actually realised I forgot to run filebeat at the same time as logstash which is why there's no output. (yes that's stupid) 😛

Btw, a brute-force method could be building a soft link between /usr/share/filebeat/bin and /usr/share/filebeat/bin/module as well. (by doing ln -s)  
I tried it before and it silents the error(though, back then I haven't realised I didn't turn on Logstash so there's still no output, but I think it's worth a shot)  
Cheers,  
TK

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2021, 4:16pm UTC](https://discuss.elastic.co/t/filebeat-configuration-module-path-issue/268871/6 "2021-05-05T16:16:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
