Filebeat.input and filebeat.config.modules:

Elastic Stack Beats
1

Hello, First I don't understand the role of this option in the config of filebeat , i read the docuentation but i don't understand exactly the fonction of it because i let it false and i receive the logs of the ubuntu in discover but in other documents people they change it to true

 # Change to true to enable this input configuration.
  enabled: false

also this cmd i want to understand it role because i let it false also and i can receive the logs

# Set to true to enable config reloading
  reload.enabled: false

thanks.

2

Hello,

You need to provide more context, what is your issue? Please share the entire filebeat.yml, it is not possible to know of what settings you are talking about.

1 Like
3

@leandrojmp thnks for response ,
i mean when i want to collect logs of ubuntu client with elastic i put this
[# Change to true to enable this input configuration.
enabled: false]

to true ? or let it by default
and for this setting also :
[# Set to true to enable config reloading
reload.enabled: false]

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.
- type: filestream

  # Unique ID among all inputs, an ID is required.
  id: my-filestream-id

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

Briefly i mean what's the role of filestream and filebeat.config.modules and what's the difference between them ?

4

Hi @morad_della3

This is simply an example for you the end user that is currently disabled.
You can remove if you like.
You can enable it and it will start to ship logs from the path.
There are many different types of filebeat inputs see here .. filestream is the most common.

This section referes to modules see here... which are a prebuilt "modules/package" to support ingesting and parsing and Dashboards etc for many OOTB / Common logs sources. .

That path is where they are stored and will be loaded from... none of the filebeat modules are enabled by default

You can leave in both, take out 1 or the other ... but you will need at least 1 input or 1 active module otherwise filebeat will have nothing to do...

if you look in the modules.d directory you will see many yml.disabled eagerly awaiting for you to enable them and provide your configurations ! :slight_smile:

5

@stephenb what's the cause of this error and what's the solution
data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).
it appeared when i installed apache module in ubuntu and i try to send logs of ubuntu to elastic server wia filebeat

6

This means that you already have a beats running.

7

I run two modules system log module and apache in the ubuntu client
what do you mean by

This means that you already have a beats running

I should stop 1 module or what ?
what the solution of this prob ?

8

This is not related to modules, but to filebeat instances, you already have one filebeat instance running in your system and you tried to run it again, so you got this error.

You can check the instance running with systemctl status filebeat or ps -ef | grep filebeat

9

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.