# Filebeat custom module

**URL:** <https://discuss.elastic.co/t/filebeat-custom-module/327509>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 12, 2023, 11:49pm UTC](https://discuss.elastic.co/t/filebeat-custom-module/327509 "2023-03-12T23:49:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![stefws](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stefws/32/6442_2.png) [@stefws](https://discuss.elastic.co/u/stefws)\
**Post date:** [March 12, 2023, 11:49pm UTC](https://discuss.elastic.co/t/filebeat-custom-module/327509/1 "2023-03-12T23:49:26Z")

</div>

Not finding the doc of modules sufficient to make me a custom module.

Would it be possible to convert a filebeat.inputs section to a filebeat.config.modules configuration?

Eg. having working filestream like this:

```auto
- type: filestream
  id: camel-integration
  enabled: true
  pipeline: pjp-camel-integration
  paths:
    - /local/*/camel/jboss/standalone/log/*/*.log
  prospector.scanner.exclude_files: ['.*control-dashboard.+']
  tags:
    - camel
    - integration-log
  parsers:
    - multiline:
        type: pattern
        # Example: [2022-03-21 21:11:05,462] ...
        pattern: '^\[[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2},[[:digit:]]{3}\]'
        negate: true
        match: after
        max_lines: 5000

```

would like to moved this to a module configuration for easier enable/disable by deployment scripts, eg.:

```auto
- module: camel-server
  type: filestream
  id: camel-integration
  enabled: true
  pipeline: pjp-camel-integration
  paths:
    - /local/*/camel/jboss/standalone/log/*/*.log
  prospector.scanner.exclude_files: ['.*control-dashboard.+']
  tags:
    - camel
    - integration-log
  parsers:
    - multiline:
        type: pattern
        # Example: [2022-03-21 21:11:05,462] ...
        pattern: '^\[[[:digit:]]{4}-[[:digit:]]{2}-[[:digit:]]{2} [[:digit:]]{2}:[[:digit:]]{2}:[[:digit:]]{2},[[:digit:]]{3}\]'
        negate: true
        match: after
        max_lines: 5000

```

filebeat test config says okay , but it fails to create a runner/crawler:

```auto
{"log.level":"error","@timestamp":"2023-03-13T00:35:19.578+0100","log.origin":{"file.name":"instance/beat.go","file.line":1071},"message":"Exiting: Failed to start crawler: creating module reloader failed: could not create module registry for filesets: error unpacking module config :error creating config from fileset camel-server/pipeline: type 'string' is not supported on top level of config, only dictionary or list","service.name":"filebeat","ecs.version":"1.6.0"}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 10, 2023, 1:50am UTC](https://discuss.elastic.co/t/filebeat-custom-module/327509/2 "2023-04-10T01:50:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.