Why filebeat input enabled=false not effective?

[strong-ge]

I set the output config enabled flag that is 'false', when start the filebeat, the harvester still exec my log file, my enabled flag is not effective?

Here is filebeat.yml:

filebeat.config.inputs:
    path: configs/*.yml
    reload.enabled: true
    reload.period: 30s

output.elasticsearch:
    enabled: true
    hosts: ["10.10.60.35:9200"]
    index: "qdata-%{[fields.uuid]}-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "qdata"
setup.template.pattern: "qdata-*"

setup.ilm.enabled: false

Here is input config file a.yml:

- type: log
  enabled: false
  paths:
    - /root/logs/application/a.log
  fields:
    uuid: 123

when i echo something to a.log, the harvester start, and the filebeat logs:

2020-05-26T14:39:33.789+0800	INFO	log/harvester.go:297	Harvester started for file: /root/logs/application/a.log
2020-05-26T14:39:34.790+0800	INFO	[publisher_pipeline_output] pipeline/output.go:101 Connecting to backoff(elasticsearch(http://10.10.60.35:9200))
2020-05-26T14:39:34.792+0800	INFO	[esclientleg]	eslegclient/connection.go:263	Attempting to connect to Elasticsearch version 7.6.2
2020-05-26T14:39:34.813+0800	INFO	[license]	licenser/es_callback.go:51	Elasticsearch license: Basic
2020-05-26T14:39:34.814+0800	INFO	[esclientleg]	eslegclient/connection.go:263	Attempting to connect to Elasticsearch version 7.6.2
2020-05-26T14:39:34.815+0800	INFO	template/load.go:89	Template qdata already exists and will not be overwritten.
2020-05-26T14:39:34.815+0800	INFO	[index-management]	idxmgmt/std.go:295	Loaded index template.
2020-05-26T14:39:34.815+0800	INFO	[publisher_pipeline_output]	pipeline/output.go:111	Connection to backoff(elasticsearch(http://10.10.60.35:9200)) established

[Andre_Letterer (André Letterer)]

Hi,

I think you are using the enabled setting wrong:

https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html#load-input-config

Your file a.yml contains the setting enabled: false. But that's the wrong place.

The enabled: false setting should be in filebeat.yml setting and means you either enable inputs or modules globally like that:

filebeat.config.inputs:
    enabled: false
    path: configs/*.yml
    reload.enabled: true
    reload.period: 30s

If you want to disable subpart a.yml or e.g. b.yml, you want to disable b.yml just rename it to b.yml.disabled, the same what happens with modules.