Each module and fileset has variables that you can set to change the default behavior of the module, including the paths where the module looks for log files. You can set the path in configuration or from the command line. For example:
To set the path at the command line, use the
-M flag. The variable name
must include the module and fileset name. For example:
deb and rpm:
filebeat -e -M "nginx.access.var.paths=[/var/log/nginx/access.log*]"
./filebeat -e -M "nginx.access.var.paths=[/usr/local/var/log/nginx/access.log*]"
PS > .\filebeat.exe -e -M "nginx.access.var.paths=[c:/programdata/nginx/logs/*access.log*]"
You can specify multiple overrides. Each override must start with
If you are running Filebeat as a service, you cannot set paths from the
command line. You must set the
var.paths option in the module configuration
For information about specific variables that you can set for each fileset, see the documentation for the modules.