Modules.d vs inputs.d vs filebeat.yml

Elastic Stack Beats
1

Hello,

I'm a newbie with filebeat. (not sure my topic is at the right place)

My question is simple :

  • How to organize by project my filebeat configuration ?

For what I understand there is 3 places to configure stuff :

  • the main configuration file.
  • the modules.d directory for "ready" to use modules
  • the inputs.d directory but not sure is maintain in last version ?

In a beautifull world I :

  • do not want to modify main file in order to not manage new configuration options when the debian package is upgrade.
  • want to use a module when the project I work on fits on a module configuration.
  • group by project (all in one file) my configurations (one server can have several project)

Thats lead me to that idea :

  • 1 main file (in inputs.d or somewhere else) to overwrite the filebeat.yml
  • 1 file by project in inputs.d if it's work today as I do not see relevant part in main configuration
  • each project file with modules + inputs configuration inside.

What do you think about it, what can I really do, what I can't ?

Thx for your time &
sry for my english.

2

Hello @Just_Two_Cat_In_ABox

Welcome to the community!!

So looking at the input below is your idea?

/etc/filebeat/
│
├── filebeat.yml  (Main config - minimal, upgrade-safe)
│   ├── filebeat.config.inputs:
│   │     path: inputs.d/*.yml
│   │     enabled: true
│   ├── filebeat.config.modules:
│   │     path: modules.d/*.yml
│   │     enabled: true
│   └── output.elasticsearch / logging / other global settings
│
├── inputs.d/     (Custom input configs grouped by project)
│   ├── projectA-inputs.yml
│   │   └── filebeat.inputs: (e.g., log paths, processors)
│   ├── projectB-inputs.yml
│   └── projectC-inputs.yml
│
├── modules.d/
│   ├── nginx.yml       (enabled: true)
│   ├── apache.yml      (enabled: true)
│   ├── system.yml      (enabled: false or true)
│   └── other modules...

Also can review below post :

Thanks!!