How to disable a Filebeat module

Disabling a Filebeat module stops that packaged log source from loading through the module system. Use it when a service is retired, a module was enabled for testing, or another input now handles the same logs.

Package-based Filebeat installs keep module definitions under /etc/filebeat/modules.d. The filebeat modules disable command moves a module from <module>.yml to <module>.yml.disabled, which removes it from the active /etc/filebeat/modules.d/*.yml loader path while keeping the packaged module file available for later re-enablement.

The modules command depends on filebeat.config.modules.path still pointing at the modules.d directory. A running service notices the renamed file only after module config reloading sees the change or after filebeat.service restarts, and disabling a module does not remove previously indexed data, standalone inputs, or any module passed at runtime with --modules.

Steps to disable a Filebeat module:

List module states to confirm the exact module name before disabling it.
```
$ sudo filebeat modules list
Enabled:
nginx

Disabled:
activemq
apache
auditd
aws
awsfargate
azure
cef
checkpoint
##### snipped #####
```
Modules appear under Enabled when a matching <module>.yml file exists in /etc/filebeat/modules.d.
Disable the module.
```
$ sudo filebeat modules disable nginx
Disabled nginx
```
Disabling the wrong module stops that module's log collection after the change is applied.
Confirm the module file was renamed out of the active modules.d glob.
```
$ sudo ls -1 /etc/filebeat/modules.d/nginx*
/etc/filebeat/modules.d/nginx.yml.disabled
```
The current filebeat.config.modules.path setting in /etc/filebeat/filebeat.yml must still point to ${path.config}/modules.d/*.yml if filebeat modules disable is expected to manage module state.
Test the Filebeat configuration before touching the running service.
```
$ sudo filebeat test config -c /etc/filebeat/filebeat.yml
Config OK
```
Related: How to test a Filebeat configuration
Restart the Filebeat service when module reloading is disabled.
```
$ sudo systemctl restart filebeat
```
If filebeat.config.modules.reload.enabled is true, Filebeat can detect the renamed module file automatically after the next reload.period scan and a restart is usually unnecessary.

Related: How to enable Filebeat config reloading
Related: How to manage the Filebeat service with systemctl in Linux
Confirm the Filebeat service is still running after the module change.
```
$ sudo systemctl is-active filebeat
active
```
If the service is not active, inspect filebeat.service logs before retrying the restart.

Related: How to manage the Filebeat service with systemctl in Linux

Verify the module now appears under Disabled.

$ sudo filebeat modules list
Enabled:

Disabled:
activemq
apache
auditd
aws
awsfargate
azure
cef
checkpoint
##### snipped #####
nginx
##### snipped #####