Each module and fileset has variables that you can set to change the default behavior of the module, including the paths where the module looks for log files. For example, the var.paths setting in the following example sets the path for nginx access log files:

- module: nginx
  access:
    var.paths: ["/var/log/nginx/access.log*"]

To set the path for Nginx access log files at the command line, you use the -M flag. For example:

./filebeat -M "nginx.access.var.paths=[/var/log/nginx/access.log*]"

When you set variables at the command line, the variable name needs to include the module and fileset name. You can specify multiple overrides. Each override must start with -M.

Here you see how to use the -M flag along with the --modules flag. This example shows how to set the paths to the access and error logs:

./filebeat --modules nginx -M "nginx.access.var.paths=[/var/log/nginx/access.log*]" -M "nginx.error.var.paths=[/var/log/nginx/error.log*]"

For information about specific variables that you can set for each fileset, see the documentation for the modules.