Correctly configured Filebeat inputs control which logs get harvested, how much data is shipped, and which files stay out of the pipeline. Tight input scope prevents noisy paths from overwhelming dashboards while reducing the risk of collecting unintended or sensitive content.

An input block tells Filebeat what to read (paths, streams) and how to read it (type, parsers). On Linux, the modern filestream input starts a harvester per matched file and tracks read offsets in the registry so restarts resume from the last position instead of rereading whole files.

Input blocks are YAML, so indentation mistakes or duplicated top-level keys can cause an input to be ignored. Each input also needs a unique and stable id; changing id can reset state tracking and trigger re-ingestion depending on the registry. Changes to /etc/filebeat/filebeat.yml require a service restart unless dynamic input reloading is explicitly configured.

Steps to configure Filebeat inputs:

  1. Create a backup copy of the current Filebeat configuration. 
    $ sudo cp /etc/filebeat/filebeat.yml /etc/filebeat/filebeat.yml.bak
  2. Open the Filebeat configuration file. 
    $ sudo nano /etc/filebeat/filebeat.yml
  3. Add a filestream input with the target paths. 
    filebeat.inputs:
  - type: filestream
    id: system-logs
    enabled: true
    paths:
      - /var/log/app.log
      - /var/log/dpkg.log

    Keep id unique and stable, and avoid duplicating the filebeat.inputs key in the YAML file.

  4. Test the configuration for syntax errors. 
    $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
Config OK

    Related: How to test a Filebeat configuration

  5. Restart the Filebeat service to apply the input changes. 
    $ sudo systemctl restart filebeat

    Related: How to manage the Filebeat service with systemctl in Linux

  6. Check the Filebeat service status. 
    $ sudo systemctl status filebeat --no-pager --lines=20
● filebeat.service - Filebeat sends log files to Logstash or directly to Elasticsearch.
     Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-01-06 22:14:06 UTC; 5s ago
   Main PID: 7639 (filebeat)
##### snipped #####

    Related: How to manage the Filebeat service with systemctl in Linux

  7. Review recent Filebeat logs for input activity. 
    $ sudo journalctl --unit=filebeat --no-pager --lines=50
Jan 06 22:14:06 host filebeat[7639]: {"log.level":"info","@timestamp":"2026-01-06T22:14:06.174Z","log.logger":"crawler","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).startInput","file.name":"beater/crawler.go","file.line":148},"message":"Starting input (ID: 15094845207509643253)","service.name":"filebeat","ecs.version":"1.6.0"}
Jan 06 22:14:06 host filebeat[7639]: {"log.level":"info","@timestamp":"2026-01-06T22:14:06.175Z","log.logger":"crawler","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Start","file.name":"beater/crawler.go","file.line":111},"message":"Loading and starting Inputs completed. Enabled inputs: 1","service.name":"filebeat","ecs.version":"1.6.0"}
Jan 06 22:14:06 host filebeat[7639]: {"log.level":"info","@timestamp":"2026-01-06T22:14:06.175Z","log.logger":"input.filestream","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/input/v2/compat.(*runner).Start.func1","file.name":"compat/compat.go","file.line":141},"message":"Input 'filestream' starting","service.name":"filebeat","id":"system-logs","ecs.version":"1.6.0"}
##### snipped #####