Filebeat module vs filebeat output plugin?


what is the difference between so called filebeat module and output plugin like:


A module is a collection of things like configurations, dashboards, ingest pipelines, ML jobs, Alerts etc.

An output is where you'd send the data that Filebeat processes.

Thanks for the answer.

Still I have some nuncertainties. I am able to provide in the filebeat input the path to the log files like this:

  # List of inputs.
    [{"paths": ["/var/log/elasticsearch/*.log"], "type": "log"}]

And in the module configuration I have also to configure:

# Module: elasticsearch
# Docs:

- module: elasticsearch
  # Server log
    enabled: true

    # Set custom paths for the log files. If left empty,
    # Filebeat will choose the paths depending on your OS.
      - /var/log/elasticsearch/*.log    
      - /var/log/elasticsearch/*_server.json

So can I leave out the input configurationn in the filebeat.yml out then? Or do I need to have both? Or is input only enough?

Just enable the module, you shouldn't need to define the input section as well.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.