# Using Modules and Custom logs **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [March 18, 2020, 9:17pm UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186 "2020-03-18T21:17:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![bmclellan](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@bmclellan](https://discuss.elastic.co/u/bmclellan)\ **Post date:** [March 18, 2020, 9:17pm UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186/1 "2020-03-18T21:17:33Z")
Hello, Is it possible to use the modules that come with filebeat and create your own custom logs as well? I attempted to follow the file structure of the 'iis' module and create my own, but it doesn't seem to be processing the pipeline I have made (despite it working in the pipeline/\_simulation) Thanks! ---
**Author:** ![bmclellan](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@bmclellan](https://discuss.elastic.co/u/bmclellan)\ **Post date:** [March 18, 2020, 9:52pm UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186/2 "2020-03-18T21:52:24Z")
Sigh, after a week, I stumbled onto a thread that said to do this from windows: ./filebeat setup --pipelines -modules="VPApp" Apparently you need to do this if you change your grok. Is this documented for filebeats windows development? I can't find it anywhere! ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [March 19, 2020, 11:47am UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186/3 "2020-03-19T11:47:42Z")
Unfortunately, the documentation on this topic is hard to find. You can read about it here: [https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html#use-ingest-pipelines](https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html#use-ingest-pipelines) Also, you can find a guide about developing your own modules: [https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html](https://www.elastic.co/guide/en/beats/devguide/current/filebeat-modules-devguide.html) Let me know if you need more help. ---
**Author:** ![bmclellan](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@bmclellan](https://discuss.elastic.co/u/bmclellan)\ **Post date:** [March 22, 2020, 7:57pm UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186/4 "2020-03-22T19:57:16Z")
Hello, I've somewhat got the custom modules figured out on Windows, however I have 2 questions still. 1 - I created a custom module and after running the pipeline update in PS, I can see it in my pipeline on Kibana (GET /\_ingest/pipeline?pretty). When I go to 'discover' in Kibana I can see the individual fields, however when I check the filebeat index, I can't see the fields created there. I have one module using the processor "grok" which looks to have updated the indext, however using processor "dissect" for my new module, it is not updating the filebeat index. Am I missing a step? 2 - I looked at the instructions creating a filebeat module in Linux and it looked pretty good, however I want to do this in Windows instead (which did not work out for me). I ended up just coping the 'iis' module flow and creating my own module based on that. My question; how do I add my fields into the index template? In Linux is creates your own fields.yml per module however in windows it looks like I should be exporting the already uploaded template: PS C:\Program Files\Filebeat\> .\filebeat.exe export template --es.version 7.6.1 | Out-File -Encoding UTF8 filebeat.template.json Updating that and then importing it back in PS \> Invoke-RestMethod -Method Put -ContentType "application/json" -InFile filebeat.template.json -Uri [http://localhost:9200/\_template/filebeat-7.6.1](http://localhost:9200/_template/filebeat-7.6.1) Is that correct? Once done should I clear out my indexes before restarting the filebeat module? Clear out all indexes: Invoke-RestMethod -Method Delete [http://localhost:9200/filebeat-\*](http://localhost:9200/filebeat-*) Thanks Barry ---
**Author:** ![bmclellan](https://avatars.discourse-cdn.com/v4/letter/b/3be4f8/32.png) [@bmclellan](https://discuss.elastic.co/u/bmclellan)\ **Post date:** [March 25, 2020, 5:46pm UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186/5 "2020-03-25T17:46:35Z")
> [@bmclellan](#): > > the custom modules figured out on Windows, however I have 2 questions still. > 1 - I created a custom module and after running the pipeline update in PS, I can see it in my pipeline on Kibana (GET /\_ingest/pipeline?pretty). When I go to 'discover' in Kibana I can see the individual fields, however when I check the filebeat index, I can't see the fields created there. I have one module using the processor "grok" which looks to have updat answering my own question #1, dissect is not creating index fields, grok is. Switch to grok, all is ok now. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [April 22, 2020, 5:46pm UTC](https://discuss.elastic.co/t/using-modules-and-custom-logs/224186/6 "2020-04-22T17:46:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.