Configure inputsedit

Filebeat modules provide the fastest getting started experience for common log formats. See Quick start: modules for common log formats to learn how to get started with modules. Also see Specify which modules to run for information about enabling and configuring modules.

To configure Filebeat manually (instead of using modules), you specify a list of inputs in the filebeat.inputs section of the filebeat.yml. Inputs specify how Filebeat locates and processes input data.

The list is a YAML array, so each input begins with a dash (-). You can specify multiple inputs, and you can specify the same input type more than once. For example:

filebeat.inputs:
- type: log
  paths:
    - /var/log/system.log
    - /var/log/wifi.log
- type: log
  paths:
    - "/var/log/apache2/*"
  fields:
    apache: true
  fields_under_root: true

Input typesedit

You can configure Filebeat to use the following inputs: