Filebeat module vs filebeat output plugin?

[Kosodrom (Kosmodrom)]

Hi,

what is the difference between so called filebeat module and output plugin like:

output.elasticsearch:

[warkolm (Mark Walkom)]

A module is a collection of things like configurations, dashboards, ingest pipelines, ML jobs, Alerts etc.

An output is where you'd send the data that Filebeat processes.

[Kosodrom (Kosmodrom)]

Thanks for the answer.

Still I have some nuncertainties. I am able to provide in the filebeat input the path to the log files like this:

filebeat:
  # List of inputs.
  inputs:
    [{"paths": ["/var/log/elasticsearch/*.log"], "type": "log"}]

And in the module configuration I have also to configure:

# Module: elasticsearch
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.6/filebeat-module-elasticsearch.html

- module: elasticsearch
  # Server log
  server:
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
    var.paths:
      - /var/log/elasticsearch/*.log    
      - /var/log/elasticsearch/*_server.json

So can I leave out the input configurationn in the filebeat.yml out then? Or do I need to have both? Or is input only enough?

[warkolm (Mark Walkom)]

Just enable the module, you shouldn't need to define the input section as well.