# Why filebeat input enabled=false not effective?

**URL:** <https://discuss.elastic.co/t/why-filebeat-input-enabled-false-not-effective/234252>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 26, 2020, 6:49am UTC](https://discuss.elastic.co/t/why-filebeat-input-enabled-false-not-effective/234252 "2020-05-26T06:49:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![strong-ge](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strong-ge/32/69612_2.png) [@strong-ge](https://discuss.elastic.co/u/strong-ge)\
**Post date:** [May 26, 2020, 6:49am UTC](https://discuss.elastic.co/t/why-filebeat-input-enabled-false-not-effective/234252/1 "2020-05-26T06:49:33Z")

</div>

I set the output config enabled flag that is 'false', when start the filebeat, the harvester still exec my log file, my enabled flag is not effective?

Here is filebeat.yml:

```
filebeat.config.inputs:
    path: configs/*.yml
    reload.enabled: true
    reload.period: 30s

output.elasticsearch:
    enabled: true
    hosts: ["10.10.60.35:9200"]
    index: "qdata-%{[fields.uuid]}-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "qdata"
setup.template.pattern: "qdata-*"

setup.ilm.enabled: false

```

Here is input config file a.yml:

```
- type: log
  enabled: false
  paths:
    - /root/logs/application/a.log
  fields:
    uuid: 123

```

when i echo something to a.log, the harvester start, and the filebeat logs:

```
2020-05-26T14:39:33.789+0800	INFO	log/harvester.go:297	Harvester started for file: /root/logs/application/a.log
2020-05-26T14:39:34.790+0800	INFO	[publisher_pipeline_output] pipeline/output.go:101 Connecting to backoff(elasticsearch(http://10.10.60.35:9200))
2020-05-26T14:39:34.792+0800	INFO	[esclientleg]	eslegclient/connection.go:263	Attempting to connect to Elasticsearch version 7.6.2
2020-05-26T14:39:34.813+0800	INFO	[license]	licenser/es_callback.go:51	Elasticsearch license: Basic
2020-05-26T14:39:34.814+0800	INFO	[esclientleg]	eslegclient/connection.go:263	Attempting to connect to Elasticsearch version 7.6.2
2020-05-26T14:39:34.815+0800	INFO	template/load.go:89	Template qdata already exists and will not be overwritten.
2020-05-26T14:39:34.815+0800	INFO	[index-management]	idxmgmt/std.go:295	Loaded index template.
2020-05-26T14:39:34.815+0800	INFO	[publisher_pipeline_output]	pipeline/output.go:111	Connection to backoff(elasticsearch(http://10.10.60.35:9200)) established
```

---

<div class="post-metadata">

**Author:** ![Andre\_Letterer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andre_letterer/32/42248_2.png) [@Andre\_Letterer](https://discuss.elastic.co/u/Andre_Letterer)\
**Post date:** [June 5, 2020, 11:58pm UTC](https://discuss.elastic.co/t/why-filebeat-input-enabled-false-not-effective/234252/3 "2020-06-05T23:58:37Z")

</div>

Hi,

I think you are using the enabled setting wrong:

[https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html#load-input-config](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-reloading.html#load-input-config)

Your file `a.yml` contains the setting `enabled: false`. But that's the wrong place.

The `enabled: false` setting should be in filebeat.yml setting and means you either enable inputs or modules globally like that:

```auto
filebeat.config.inputs:
    enabled: false
    path: configs/*.yml
    reload.enabled: true
    reload.period: 30s

```

If you want to disable subpart `a.yml` or e.g. `b.yml`, you want to disable `b.yml` just rename it to `b.yml.disabled`, the same what happens with modules.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 3, 2020, 11:58pm UTC](https://discuss.elastic.co/t/why-filebeat-input-enabled-false-not-effective/234252/4 "2020-07-03T23:58:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.