# Filebeat module specific output : why is this a global config?
**URL:** https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741
**Category:** Beats
**Tags:** filebeat
**Created:** [May 18, 2023, 8:35am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741 "2023-05-18T08:35:16Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [May 18, 2023, 8:35am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/1 "2023-05-18T08:35:16Z")
I have multiple modules active and like to have each module output saved to a distinct location as I choose file ouput (no elastic integration)
I see the output configuration as part of filebeat.yml, which is a global configuration
output.file:
```auto
output.file:
# Boolean flag to enable or disable the output module.
enabled: true
# Configure JSON encoding
codec.json:
# Pretty-print JSON event
pretty: true
# Path to the directory where to save the generated files. The option is
# mandatory.
path: "/var/crystaleye/azure1"
```
I tried moving the file.output section to module but it does not store any output at all
How to achieve this? I dont find any documentation which covers this as a module configuration
such as part of /etc/filebeat/modules.d/o365.yml
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [May 18, 2023, 10:41am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/2 "2023-05-18T10:41:44Z")
It's possible, set everything to make sure that input, processing is working fine.
```auto
output.console:
pretty: true
```
If you see expected data on console, switch to the file mode. What can be possible:
- not configured the module, usually path to logs, in your case o365.yml
- something is not OK in input settings.
- your data is already read, (re)move the registry file
- enable debug mode
---
### Author:  [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [May 18, 2023, 5:34pm UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/3 "2023-05-18T17:34:20Z")
This is the file:
```auto
- module: o365
audit:
enabled: true
var.application_id: "xxx-fa26-4a70-8c35-a4be3998df9a"
retention_period: 60
var.tenants:
- id: "xxx-8d5f-4b63-b75c-xxx"
name: "xxxxx.onmicrosoft.com"
var.client_secret: "eS18Q~2IUIHUZR0MwITSUsPEMe505SwHDATLXbHC"
var.content_type:
- "Audit.AzureActiveDirectory"
- "Audit.Exchange"
- "Audit.SharePoint"
- "Audit.General"
- "DLP.All"
poll_interval: 40s
output.file:
enabled: true
codec.json:
pretty: true
path: "/var/crystaleye/azure1"
```
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [May 18, 2023, 5:38pm UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/4 "2023-05-18T17:38:56Z")
The module settings look OK. Add log and set debug level for more info.
---
### Author:  [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [May 20, 2023, 4:41am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/5 "2023-05-20T04:41:27Z")
Tried this but dont find any relevant debug logs. This log shows up frequently
`{"log.level":"debug","@timestamp":"2023-05-20T10:09:41.546+0530","log.logger":"cfgfile","log.origin":{"file.name":"cfgfile/reload.go","file.line":194},"message":"Scan for new config files","service.name":"filebeat","ecs.version":"1.6.0"}`
So I am thinking the file output mode is not often used and this is a basic bug and not reported by the folks?
The question is about filebeat logs and module output configuration should be in diffferent levels
Configuration of
- filebeat logs : filebeat.yml
- module specific output: modules.d/\
---
### Author:  [@sriramb12](https://discuss.elastic.co/u/sriramb12)
#### Post date: [May 22, 2023, 5:10am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/6 "2023-05-22T05:10:44Z")
I don't call it a bug, since such a requirement is not specified may be ? Can we consider this as a feature request or an improvement ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2023, 7:11am UTC](https://discuss.elastic.co/t/filebeat-module-specific-output-why-is-this-a-global-config/333741/7 "2023-06-19T07:11:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.