Can Filebeat Use Multiple Config Files?

Yes, Filebeat can use multiple configuration files. This is useful for organizing complex configurations or managing configurations for different environments. Here’s how you can configure Filebeat to use multiple configuration files:

1. Directory Structure

You can place your additional configuration files in a directory and then include that directory in the main filebeat.yml configuration file. The structure might look something like this:

filebeat/
├── filebeat.yml
├── config/
│   ├── input1.yml
│   ├── input2.yml
│   └── output.yml

2. Main Configuration File

In your main filebeat.yml file, use the filebeat.config section to include additional configuration files. Here’s an example configuration:

filebeat.inputs:
  - type: log
    paths:
      - /var/log/*.log

filebeat.config:
  inputs:
    path: ${path.config}/config/*.yml
    reload.enabled: true
    reload.period: 10s
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true
    reload.period: 10s

output.elasticsearch:
  hosts: ["localhost:9200"]

3. Configuration Directories

• Inputs Configuration: You can place your input configurations in a directory like config/inputs/. In this case, your filebeat.yml should reference that directory:

   

  Copied!

  filebeat.config.inputs:
    path: ${path.config}/config/inputs/*.yml
  

• Modules Configuration: If you use Filebeat modules, you can place the module configurations in a directory and reference it:

   

  Copied!

  filebeat.config.modules:
    path: ${path.config}/config/modules/*.yml
  

4. Dynamic Configuration Reloading

Filebeat supports dynamic configuration reloading, allowing you to add or modify configurations without restarting Filebeat. Ensure that reload.enabled is set to true and specify the reload.period to define how often Filebeat checks for changes.

5. Example of Multiple Config Files

Main filebeat.yml:

filebeat.config:
  inputs:
    path: ${path.config}/inputs/*.yml
    reload.enabled: true
    reload.period: 10s

  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: true
    reload.period: 10s

output.elasticsearch:
  hosts: ["localhost:9200"]

config/inputs/input1.yml:

- type: log
  paths:
    - /var/log/input1.log

config/inputs/input2.yml:

- type: log
  paths:
    - /var/log/input2.log

6. Applying Configuration

After setting up your configurations, restart Filebeat to apply the changes:

filebeat restart

By organizing your configuration files this way, you can manage complex setups more easily and maintain clarity in your Filebeat configuration.

Got an article suggestion? Let us know

Explore more

Filebeat

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.