Advanced settingsedit

Behind the scenes, each module starts a Filebeat input. Advanced users can add or override any input settings. For example, you can set close_eof to true in the module configuration:

- module: nginx
  access:
    input:
      close_eof: true

Or at the command line like this:

./filebeat -M "nginx.access.input.close_eof=true"

Here you see how to use the -M flag along with the --modules flag:

./filebeat --modules nginx -M "nginx.access.input.close_eof=true"

You can use wildcards to change variables or settings for multiple modules/filesets at once. For example, the following command enables close_eof for all the filesets in the nginx module:

./filebeat -M "nginx.*.input.close_eof=true"

The following command enables close_eof for all inputs created by any of the modules:

./filebeat -M "*.*.input.close_eof=true"