# How to connect prospector to custom module

**URL:** <https://discuss.elastic.co/t/how-to-connect-prospector-to-custom-module/233768>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 21, 2020, 3:38pm UTC](https://discuss.elastic.co/t/how-to-connect-prospector-to-custom-module/233768 "2020-05-21T15:38:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jonny\_McCullagh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jonny_mccullagh/32/68830_2.png) [@Jonny\_McCullagh](https://discuss.elastic.co/u/Jonny_McCullagh)\
**Post date:** [May 21, 2020, 3:38pm UTC](https://discuss.elastic.co/t/how-to-connect-prospector-to-custom-module/233768/1 "2020-05-21T15:38:34Z")

</div>

I am able to get logs going to elasticsearch using the following: `/etc/filebeat/conf.d/lwrp-prospector-airflow.yml`

```auto
    ---
    filebeat:
      prospectors:
      - paths:
        - "/var/log/airflow/*.log"
        enabled: true

```

But I want to chop up the log line and came up with a grok pattern to do so.  
So I copied an existing module (apache2) to a new folder and modified the contents including adding my grok pattern to `/usr/share/filebeat/module/airflow/dags/ingest/default.json`

```auto
     {
  "description": "Pipeline for parsing Airflow logs.",
  "processors": [{
    "grok": {
      "field": "message",
      "patterns":[
        "\[%{TIMESTAMP_ISO8601:timestamp}\] \{\{%{NOTSPACE:scriptname}:%{NUMBER:dag_id}}\} %{LOGLEVEL:level} - %{GREEDYDATA:airflow_message}"
        ],
      "ignore_missing": true
    }
  },{
    "remove":{
      "field": "message"
    } ......

```

But now I'm stuck. How do I tell the prospector to use this processor from my custom module?  
Any help is appreciated.

ubuntu: 16.04  
filebeat 6.0.1

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 18, 2020, 3:38pm UTC](https://discuss.elastic.co/t/how-to-connect-prospector-to-custom-module/233768/2 "2020-06-18T15:38:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.