Multiple YAML Files (Modular Configs)

Elastic Stack Beats
1

would have several smaller YAML files, and the primary configuration (filebeat.yml) will reference them.?

/etc/filebeat/
├── filebeat.yml # Main configuration file
├── inputs.yml # Input-specific settings
├── processors.yml # Processor-specific settings
├── outputs.yml # Output settings
└── logging.yml # Logging-specific settings
ould have several smaller YAML files, and the primary configuration (filebeat.yml) will reference them.
filebeat.config:
inputs:
enabled: true
path: /etc/filebeat/inputs.yml
processors:
enabled: true
path: /etc/filebeat/processors.yml
outputs:
enabled: true
path: /etc/filebeat/outputs.yml
logging:
enabled: true
path: /etc/filebeat/logging.yml

2

This is not possible, it is not supported, you need to use filebeat.yml for those configurations, except the inputs.

For the inputs you can load its configuration from external config files as described in the documentation.

I have something like this.

The filebeat.yml would look like this:

name: "node-name"

filebeat.config.inputs:
  enabled: true
  path: "/etc/filebeat/inputs/*.yml"

setup.ilm.enabled: false
ilm.enabled: false
setup.template.enabled: false

queue.mem:
  events: 8000
  flush.min_events: 500
  flush.timeout: 1s

output.kafka:
  output configuration

Then in the /etc/filebeat/inputs/ path I would put multiple yml files with the inputs I want, something like this:

- type: filestream
  paths:
    - /path/to/file/*.json