How to enable Filebeat config reloading

Dynamic input reloading keeps Filebeat collecting logs as new applications appear and old ones disappear. Breaking inputs into small snippet files reduces configuration churn and avoids repeated full-service restarts during routine onboarding or deployments.

Dynamic reloading works by loading external input definitions from a watched file Glob configured under filebeat.config.inputs. When reload.enabled is active, Filebeat periodically checks the snippet directory and starts or stops inputs based on changes to matching files.

Reloading applies to externally loaded input (and module) snippets, not the main /etc/filebeat/filebeat.yml, so updates to the main config still require a restart. File ownership and permission checks apply on POSIX systems, and insecure permissions can prevent Filebeat from starting. Keep each snippet file as a YAML list that begins with - type , avoid overlapping paths across inputs, and use a conservative reload.period to limit overhead.

1. Create a dedicated input snippet directory.

   $ sudo mkdir -p /etc/filebeat/inputs.d

   Keep /etc/filebeat/inputs.d writable only by trusted administrators to prevent unexpected input definitions from being loaded.

2. Add an external input loader to /etc/filebeat/filebeat.yml.

   filebeat.config.inputs:
     enabled: true
     path: /etc/filebeat/inputs.d/*.yml
     reload.enabled: true
     reload.period: 10s

   reload.period values below 1s can miss file modification timestamps and add unnecessary overhead.

3. Create an input definition file such as /etc/filebeat/inputs.d/app.yml.

   - type: filestream
     id: app-logs
     paths:
       - /var/log/app.log

   Keep id values unique and avoid overlapping paths between inputs, or the same file can be harvested twice and produce duplicates.

4. Test the Filebeat configuration for syntax errors.

   $ sudo filebeat test config
   Config OK

   Related: How to test a Filebeat configuration

5. Restart the Filebeat service to activate input reloading.

   $ sudo systemctl restart filebeat

   Related: How to manage the Filebeat service with systemctl in Linux

6. Add another input snippet file to confirm live reloads without restarting.

   $ sudo tee /etc/filebeat/inputs.d/nginx.yml >/dev/null <<'YAML'
   - type: filestream
     id: nginx-access
     paths:
       - /var/log/nginx/access.log
   YAML

7. Review Filebeat logs after at least one reload.period interval for reload activity.

   $ sudo journalctl --unit=filebeat --no-pager --lines=30
   Jan 06 22:27:40 host filebeat[8999]: {"log.level":"info","@timestamp":"2026-01-06T22:27:40.308Z","log.logger":"crawler.input.reloader","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cfgfile.(*Reloader).Run","file.name":"cfgfile/reload.go","file.line":163},"message":"Config reloader started","service.name":"filebeat","ecs.version":"1.6.0"}
   Jan 06 22:27:50 host filebeat[8999]: {"log.level":"info","@timestamp":"2026-01-06T22:27:50.311Z","log.logger":"input.filestream","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1","file.name":"compat/compat.go","file.line":141},"message":"Input 'filestream' starting","service.name":"filebeat","id":"app-logs","ecs.version":"1.6.0"}
   Jan 06 22:28:00 host filebeat[8999]: {"log.level":"info","@timestamp":"2026-01-06T22:28:00.318Z","log.logger":"input.filestream","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1","file.name":"compat/compat.go","file.line":141},"message":"Input 'filestream' starting","service.name":"filebeat","id":"nginx-access","ecs.version":"1.6.0"}
   ##### snipped #####