Override configuration settings at the command line

Stack

You can override any configuration setting from the command line by using flags:

-E, --E "SETTING_NAME=VALUE"

Overrides a specific configuration setting.

-M, --M "VAR_NAME=VALUE"

Overrides the default configuration for a module.

You can specify multiple overrides. Overrides are applied to the currently running Filebeat process. The Filebeat configuration file is not changed.

The following configuration sends logging output to files:

 logging.level: info logging.to_files: true logging.files: path: /var/log/filebeat name: filebeat keepfiles: 7 permissions: 0640 

To override the logging level and send logging output to standard error instead of a file, use the -E flag when you run Filebeat:

 -E "logging.to_files=false" -E "logging.to_stderr=true" -E "logging.level=error" 

The following configuration sets the path to Nginx access logs:

 - module: nginx access: var.paths: ["/var/log/nginx/access.log*"] 

To override the var.paths setting from the command line, use the -M flag when you run Filebeat. The variable name must include the module and fileset name. For example:

 -M "nginx.access.var.paths=[/path/to/log/nginx/access.log*]" 

You can specify multiple overrides. Each override must start with -M.

For information about specific variables that you can set for each fileset, see the documentation under Modules.