How to disable a Filebeat module

Disabling a Filebeat module stops that packaged log source from loading through the module system. Use it when a service is retired, a module was enabled for testing, or another input now handles the same logs.

Package-based Filebeat installs keep module definitions under /etc/filebeat/modules.d. The filebeat modules disable command moves a module from <module>.yml to <module>.yml.disabled, which removes it from the active /etc/filebeat/modules.d/*.yml loader path while keeping the packaged module file available for later re-enablement.

The modules command depends on filebeat.config.modules.path still pointing at the modules.d directory. A running service notices the renamed file only after module config reloading sees the change or after filebeat.service restarts, and disabling a module does not remove previously indexed data, standalone inputs, or any module passed at runtime with --modules.

1. List module states to confirm the exact module name before disabling it.

   $ sudo filebeat modules list
   Enabled:
   nginx
   
   Disabled:
   activemq
   apache
   auditd
   aws
   awsfargate
   azure
   cef
   checkpoint
   ##### snipped #####

   Modules appear under Enabled when a matching <module>.yml file exists in /etc/filebeat/modules.d.

2. Disable the module.

   $ sudo filebeat modules disable nginx
   Disabled nginx

   Disabling the wrong module stops that module's log collection after the change is applied.

3. Confirm the module file was renamed out of the active modules.d glob.

   $ sudo ls -1 /etc/filebeat/modules.d/nginx*
   /etc/filebeat/modules.d/nginx.yml.disabled

   The current filebeat.config.modules.path setting in /etc/filebeat/filebeat.yml must still point to ${path.config}/modules.d/*.yml if filebeat modules disable is expected to manage module state.

4. Test the Filebeat configuration before touching the running service.

   $ sudo filebeat test config -c /etc/filebeat/filebeat.yml
   Config OK

   Related: How to test a Filebeat configuration

5. Restart the Filebeat service when module reloading is disabled.

   $ sudo systemctl restart filebeat

   If filebeat.config.modules.reload.enabled is true, Filebeat can detect the renamed module file automatically after the next reload.period scan and a restart is usually unnecessary.

   Related: How to enable Filebeat config reloading
   Related: How to manage the Filebeat service with systemctl in Linux

6. Confirm the Filebeat service is still running after the module change.

   $ sudo systemctl is-active filebeat
   active

   If the service is not active, inspect filebeat.service logs before retrying the restart.

   Related: How to manage the Filebeat service with systemctl in Linux

7. Verify the module now appears under Disabled.

   $ sudo filebeat modules list
   Enabled:
   
   Disabled:
   activemq
   apache
   auditd
   aws
   awsfargate
   azure
   cef
   checkpoint
   ##### snipped #####
   nginx
   ##### snipped #####