Override input settings

Stack

Behind the scenes, each module starts a Filebeat input. Advanced users can add or override any input settings. For example, you can set close_eof to true in the module configuration:

 - module: nginx access: input: close_eof: true 

Or at the command line when you run Filebeat:

 -M "nginx.access.input.close_eof=true" 

You can use wildcards to change variables or settings for multiple modules/filesets at once. For example, you can enable close_eof for all the filesets in the nginx module:

 -M "nginx.*.input.close_eof=true" 

You can also enable close_eof for all inputs created by any of the modules:

 -M "*.*.input.close_eof=true"