Using modules alongside "normal" log processing

I can answer part of this maybe. Module source file names/paths have defaults, in this case in /usr/share/filebeat/module/haproxy/log/manifest.yml.

Modules are designed to work with Elasticsearch ingest and it's easier to go with that if you can. If you want to go thru logstash, you need to convert the ingest pipelines to logstash, see this. However, some things don't convert and must be hand coded or use features that aren't available in Logstash.

I think you would want to exclude the haproxy logs from the general section, at least per this post, it seems like it could cause problems.

Good luck :slight_smile: