I use puppet to maintain *beat across the fleet. If there is a *beat module in existence I just rename / replace it from the .disabled version.
What I don't see to have is a module for zookeeper. It produces a single file to /var/log/zookeeper and I'd like to ingest it. I've tried adding simple .yml files to /etc/filebeat/modules.d but they don't get picked up (IE I don't see filebeat reading the file).
Is it possible to add a simple .yml to /etc/filebeat/modules.d to read an arbitrary log file? Or do I need to write a custom module?
using elastic 7.11.1 across the board.