# How to only load enabled-module dashboards with \`filebeat setup\`

**URL:** <https://discuss.elastic.co/t/how-to-only-load-enabled-module-dashboards-with-filebeat-setup/321913>\
**Category:** Beats\
**Tags:** docker, filebeat\
**Created:** [December 23, 2022, 12:50pm UTC](https://discuss.elastic.co/t/how-to-only-load-enabled-module-dashboards-with-filebeat-setup/321913 "2022-12-23T12:50:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![brsolomon](https://avatars.discourse-cdn.com/v4/letter/b/8491ac/32.png) [@brsolomon](https://discuss.elastic.co/u/brsolomon)\
**Post date:** [December 23, 2022, 12:50pm UTC](https://discuss.elastic.co/t/how-to-only-load-enabled-module-dashboards-with-filebeat-setup/321913/1 "2022-12-23T12:50:03Z")

</div>

It seems that the default behavior of `filebeat setup --dashboards` is to load _all_ dashboards rather than just dashboards for the modules enabled via config or `--modules`.

Is there a way to only have `filebeat setup --dashboards` load Kibana dashboards for one specific module? Otherwise, it takes a significant amount of time for `filebeat setup` to run and load about 80 dashboards that we don't use.

Reproducible example from `docker.elastic.co/beats/filebeat:8.5.3`:

```nohighlight
cat << EOF > /tmp/filebeat.yml
filebeat.config:
  modules:
    path: \${path.config}/modules.d/*.yml
    reload.enabled: false
filebeat.overwrite_pipelines: true
filebeat.modules:
  - module: suricata
    eve:
      enabled: true
      var.paths: ["/var/log/suricata/eve.json"]
setup.kibana:
  host: kibana-8-kb-http:5601
  protocol: http
  username: REDACTED
  password: REDACTED
output.elasticsearch:
  hosts: ["elastic8-es-http:9200"]
  protocol: https
  ssl:
    verification_mode: none
  username: REDACTED
  password: REDACTED
  index: "suricata-eve-%{[agent.version]}"
setup.dashboards:
  enabled: true
  index: "suricata-eve-*"
setup.template:
  enabled: true
  name: "suricata-eve-%{[agent.version]}"
  pattern: "suricata-eve-%{[agent.version]}"
  overwrite: true
  settings:
    index.number_of_shards: 5
    index.number_of_replicas: 1
setup.ilm:
  enabled: true
  policy_name: 90-days-default
EOF

filebeat setup \
    -e \
    --path.config /tmp \
    --pipelines \
    --dashboards \
    --index-management \
    --modules suricata

```

Note: the setup above is for a Filebeat-\>Kafka-\>Logstash-\>Elasticsearch pipeline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 20, 2023, 2:50pm UTC](https://discuss.elastic.co/t/how-to-only-load-enabled-module-dashboards-with-filebeat-setup/321913/2 "2023-01-20T14:50:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.