# Module with custom input?

**URL:** https://discuss.elastic.co/t/module-with-custom-input/231097
**Category:** Beats
**Tags:** beats-module, filebeat
**Created:** [May 5, 2020, 7:55am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097 "2020-05-05T07:55:25Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![hazcod](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hazcod/32/67689_2.png) [@hazcod](https://discuss.elastic.co/u/hazcod)
#### Post date: [May 5, 2020, 7:55am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097/1 "2020-05-05T07:55:26Z")

</div>

Hi,

Is there a method to use module parsing with your own custom input declaration?  
e.g.

```
- module: checkpoint
  access:
input:
- type: syslog
protocol.tcp:
  host: "0.0.0.0:8001"
tls:
  certificate: foo
  key: bar
```

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [May 5, 2020, 11:30am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097/2 "2020-05-05T11:30:59Z")

</div>

Hi @hazcod!

It seems that no. [Inputs](https://www.elastic.co/guide/en/beats/filebeat/master/configuration-filebeat-options.html#configuration-filebeat-options) are meant to replace `modules` where modules are not enough to support a case.

---

<div class="post-metadata">

### Author: ![hazcod](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hazcod/32/67689_2.png) [@hazcod](https://discuss.elastic.co/u/hazcod)
#### Post date: [May 5, 2020, 11:31am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097/3 "2020-05-05T11:31:56Z")

</div>

Hi @ChrsMark, that's a bummer... I would want to use mutual TLS for syslog connections, but no modules support that. Can I utilise the module parsing on its own?

In my case I want to use the CheckPoint-\>ECS parser, but with mutual TLS input.

---

<div class="post-metadata">

### Author: ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)
#### Post date: [May 5, 2020, 11:41am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097/4 "2020-05-05T11:41:57Z")

</div>

So [`checkpoint`](https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-checkpoint.html) module supports syslog or file as inputs. Sample config: [https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/checkpoint/\_meta/config.yml](https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/checkpoint/_meta/config.yml)

The question is if you can specify TLS settings in order to collect securely? From the documentation it seems that it is not supported. I would suggest you open a Github issue for this requesting this enhancement (if it is already supported and we missed that then it should be documented). What do you think?

---

<div class="post-metadata">

### Author: ![hazcod](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hazcod/32/67689_2.png) [@hazcod](https://discuss.elastic.co/u/hazcod)
#### Post date: [May 5, 2020, 11:43am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097/5 "2020-05-05T11:43:03Z")

</div>

That's what I was afraid for.. I've opened up a PR for it last week: [https://github.com/elastic/beats/pull/18116](https://github.com/elastic/beats/pull/18116)

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 2, 2020, 11:43am UTC](https://discuss.elastic.co/t/module-with-custom-input/231097/6 "2020-06-02T11:43:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
