WARNING: Version 6.0 of Filebeat has passed its EOL date.
This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.
Behind the scenes, each module starts a Filebeat prospector. Advanced users
can add or override any prospector settings. For example, you can set
true in the module configuration:
- module: nginx access: prospector: close_eof: true
Or at the command line like this:
./filebeat -M "nginx.access.prospector.close_eof=true"
Here you see how to use the
-M flag along with the
./filebeat --modules nginx -M "nginx.access.prospector.close_eof=true"
You can use wildcards to change variables or settings for multiple
modules/filesets at once. For example, the following command enables
close_eof for all the filesets in the
./filebeat -M "nginx.*.prospector.close_eof=true"
The following command enables
close_eof for all prospectors created by any of
./filebeat -M "*.*.prospector.close_eof=true"