How to disable a Filebeat module

Disabling a Filebeat module stops its prebuilt inputs from collecting and shipping logs, keeping indices focused and reducing ingest pipeline load.

Modules are managed as individual configuration files under /etc/filebeat/modules.d, and the filebeat modules disable command toggles a module off by renaming its definition so it no longer matches the loader path (commonly from .yml to .yml.disabled).

Most Filebeat deployments load modules at startup, so changes under /etc/filebeat/modules.d typically require restarting the service to fully unload the module. Disabling a module does not delete already-ingested data and does not affect custom inputs defined outside the module system.

Steps to disable a Filebeat module:

List module states to confirm the module name.
```
$ sudo filebeat modules list
Enabled:
nginx
system

Disabled:
activemq
apache
auditd
aws
awsfargate
azure
##### snipped #####
```
Modules listed under Disabled commonly have a .yml.disabled file under /etc/filebeat/modules.d.
Disable the module.
```
$ sudo filebeat modules disable nginx
Disabled nginx
```
Disabling the wrong module stops log shipping for that service and can create monitoring gaps.

Disabling renames /etc/filebeat/modules.d/nginx.yml to /etc/filebeat/modules.d/nginx.yml.disabled. Re-enable with filebeat modules enable nginx.
Test the Filebeat configuration for syntax errors.
```
$ sudo filebeat test config
Config OK
```
Related: How to test a Filebeat configuration
Restart the Filebeat service to unload the module.
```
$ sudo systemctl restart filebeat
```
Restarting Filebeat with an invalid configuration stops log shipping until the configuration is fixed.

Related: How to manage the Filebeat service with systemctl in Linux

Confirm the Filebeat service is running.

$ sudo systemctl status filebeat
● filebeat.service - Filebeat sends log files to Logstash or Elasticsearch.
     Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; preset: enabled)
     Active: active (running) since Tue 2026-01-06 20:58:03 UTC; 4s ago
##### snipped #####

Verify the module appears under Disabled.

$ sudo filebeat modules list
Enabled:
system

Disabled:
activemq
apache
auditd
aws
awsfargate
azure
##### snipped #####

Author: Mohd Shakir Zakaria
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.