# Modules.d vs inputs.d vs filebeat.yml

**URL:** <https://discuss.elastic.co/t/modules-d-vs-inputs-d-vs-filebeat-yml/380754>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 5, 2025, 10:30am UTC](https://discuss.elastic.co/t/modules-d-vs-inputs-d-vs-filebeat-yml/380754 "2025-08-05T10:30:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Just\_Two\_Cat\_In\_ABox](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/just_two_cat_in_abox/32/144482_2.png) [@Just\_Two\_Cat\_In\_ABox](https://discuss.elastic.co/u/Just_Two_Cat_In_ABox)\
**Post date:** [August 5, 2025, 10:30am UTC](https://discuss.elastic.co/t/modules-d-vs-inputs-d-vs-filebeat-yml/380754/1 "2025-08-05T10:30:33Z")

</div>

Hello,

I'm a newbie with filebeat. (not sure my topic is at the right place)

My question is simple :

- How to organize by project my filebeat configuration ?

For what I understand there is 3 places to configure stuff :

- the main configuration file.
- the modules.d directory for "ready" to use modules
- the inputs.d directory but not sure is maintain in last version ?

In a beautifull world I :

- do not want to modify main file in order to not manage new configuration options when the debian package is upgrade.
- want to use a module when the project I work on fits on a module configuration.
- group by project (all in one file) my configurations (one server can have several project)

Thats lead me to that idea :

- 1 main file (in inputs.d or somewhere else) to overwrite the filebeat.yml
- 1 file by project in inputs.d if it's work today as I do not see relevant part in main configuration
- each project file with modules + inputs configuration inside.

What do you think about it, what can I really do, what I can't ?

Thx for your time &  
sry for my english.

---

<div class="post-metadata">

**Author:** ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Post date:** [August 14, 2025, 8:23am UTC](https://discuss.elastic.co/t/modules-d-vs-inputs-d-vs-filebeat-yml/380754/2 "2025-08-14T08:23:39Z")

</div>

Hello @Just_Two_Cat_In_ABox

Welcome to the community!!

So looking at the input below is your idea?

```auto
/etc/filebeat/
│
├── filebeat.yml (Main config - minimal, upgrade-safe)
│ ├── filebeat.config.inputs:
│ │ path: inputs.d/*.yml
│ │ enabled: true
│ ├── filebeat.config.modules:
│ │ path: modules.d/*.yml
│ │ enabled: true
│ └── output.elasticsearch / logging / other global settings
│
├── inputs.d/ (Custom input configs grouped by project)
│ ├── projectA-inputs.yml
│ │ └── filebeat.inputs: (e.g., log paths, processors)
│ ├── projectB-inputs.yml
│ └── projectC-inputs.yml
│
├── modules.d/
│ ├── nginx.yml (enabled: true)
│ ├── apache.yml (enabled: true)
│ ├── system.yml (enabled: false or true)
│ └── other modules...

```

Also can review below post :

> [@Multiple YAML Files (Modular Configs)](https://discuss.elastic.co/t/multiple-yaml-files-modular-configs/376399/2):
>
> This is not possible, it is not supported, you need to use filebeat.yml for those configurations, except the inputs. For the inputs you can load its configuration from external config files as described [in the documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html). I have something like this. The filebeat.yml would look like this: name: "node-name" filebeat.config.inputs: enabled: true path: "/etc/filebeat/inputs/\*.yml" setup.ilm.enabled: false ilm.enabled: false setup.template.enabled: false queue.mem: events: 8000 flu…

Thanks!!