# Filebeat.input and filebeat.config.modules:

**URL:** <https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [September 20, 2022, 11:30am UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773 "2022-09-20T11:30:10Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 20, 2022, 11:30am UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/1 "2022-09-20T11:30:10Z")

</div>

Hello, First I don't understand the role of this option in the config of filebeat , i read the docuentation but i don't understand exactly the fonction of it because i let it false and i receive the logs of the ubuntu in discover but in other documents people they change it to true

```auto
 # Change to true to enable this input configuration.
  enabled: false

```

also this cmd i want to understand it role because i let it false also and i can receive the logs

```auto
# Set to true to enable config reloading
  reload.enabled: false

```

thanks.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 20, 2022, 12:55pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/2 "2022-09-20T12:55:08Z")

</div>

Hello,

You need to provide more context, what is your issue? Please share the **entire** `filebeat.yml`, it is not possible to know of what settings you are talking about.

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 20, 2022, 1:14pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/3 "2022-09-20T13:14:04Z")

</div>

@leandrojmp thnks for response ,  
i mean when i want to collect logs of ubuntu client with elastic i put this  
[# Change to true to enable this input configuration.  
enabled: false]

to true ? or let it by default  
and for this setting also :  
[# Set to true to enable config reloading  
reload.enabled: false]

```auto
filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so
# you can use different inputs for various configurations.
# Below are the input specific configurations.

# filestream is an input for collecting log messages from files.
- type: filestream

  # Unique ID among all inputs, an ID is required.
  id: my-filestream-id

  # Change to true to enable this input configuration.
  enabled: false

  # Paths that should be crawled and fetched. Glob based paths.
  paths:
    - /var/log/*.log
    #- c:\programdata\elasticsearch\logs\*

```

```auto
filebeat.config.modules:
  # Glob pattern for configuration loading
  path: ${path.config}/modules.d/*.yml

  # Set to true to enable config reloading
  reload.enabled: false

  # Period on which files under path should be checked for changes
  #reload.period: 10s

```

Briefly i mean what's the role of filestream and filebeat.config.modules and what's the difference between them ?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [September 20, 2022, 9:57pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/4 "2022-09-20T21:57:06Z")

</div>

Hi @morad_della3

> [@morad\_della3](#):
>
> ```auto
> filebeat.inputs:
> 
> # Each - is an input. Most options can be set at the input level, so
> # you can use different inputs for various configurations.
> # Below are the input specific configurations.
> 
> # filestream is an input for collecting log messages from files.
> - type: filestream
> 
> # Unique ID among all inputs, an ID is required.
> id: my-filestream-id
> 
> # Change to true to enable this input configuration.
> enabled: false
> .....
> 
> ```

This is simply an example for you the end user that is currently disabled.  
You can remove if you like.  
You can enable it and it will start to ship logs from the path.  
There are many different types of filebeat inputs see [here](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html) .. filestream is the most common.

> [@morad\_della3](#):
>
> ```auto
> filebeat.config.modules:
> # Glob pattern for configuration loading
> path: ${path.config}/modules.d/*.yml <!---- modules stored here
> 
> ```

This section referes to modules see [here](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-modules.html)... which are a prebuilt "modules/package" to support ingesting and parsing and Dashboards etc for many OOTB / Common logs sources. .

That path is where they are stored and will be loaded from... none of the filebeat modules are enabled by default

You can leave in both, take out 1 or the other ... but you will need at least 1 input or 1 active module otherwise filebeat will have nothing to do...

if you look in the `modules.d` directory you will see many `yml.disabled` eagerly awaiting for you to enable them and provide your configurations ! 🙂

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 20, 2022, 10:06pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/5 "2022-09-20T22:06:28Z")

</div>

@stephenb what's the cause of this error and what's the solution  
`data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).`  
it appeared when i installed apache module in ubuntu and i try to send logs of ubuntu to elastic server wia filebeat

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 20, 2022, 10:16pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/6 "2022-09-20T22:16:52Z")

</div>

> [@morad\_della3](#):
>
> data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data).

This means that you already have a beats running.

---

<div class="post-metadata">

**Author:** ![morad\_della3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/morad_della3/32/101241_2.png) [@morad\_della3](https://discuss.elastic.co/u/morad_della3)\
**Post date:** [September 21, 2022, 9:02am UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/7 "2022-09-21T09:02:40Z")

</div>

I run two modules system log module and apache in the ubuntu client  
what do you mean by

> This means that you already have a beats running

I should stop 1 module or what ?  
what the solution of this prob ?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 21, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/8 "2022-09-21T13:16:32Z")

</div>

This is not related to modules, but to filebeat instances, you already have one filebeat instance running in your system and you tried to run it again, so you got this error.

You can check the instance running with `systemctl status filebeat` or `ps -ef | grep filebeat`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 19, 2022, 1:17pm UTC](https://discuss.elastic.co/t/filebeat-input-and-filebeat-config-modules/314773/9 "2022-10-19T13:17:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.