Listing Filebeat modules exposes which prebuilt integrations are available and which ones are currently enabled, making audits and troubleshooting faster.

A Filebeat module bundles input settings, ingest pipelines, and Kibana dashboards for a specific service. The filebeat modules list command reads the installed module registry and reports module state based on the enabled configuration files.

On Linux package installs, module state is controlled by files in /etc/filebeat/modules.d, where enabled modules use a .yml filename and disabled modules carry a .yml.disabled suffix. Archive installations keep the same structure under the extracted Filebeat directory, and Elastic Agent-managed integrations do not use modules.d. An enabled module only confirms configuration is active; successful ingestion still depends on outputs, permissions, and pipeline availability in the destination.

Steps to list Filebeat modules:

  1. List enabled and disabled Filebeat modules. 
    $ sudo filebeat modules list
Enabled:
nginx
system

Disabled:
activemq
apache
auditd
aws
awsfargate
azure
##### snipped #####

    Modules appear under Enabled when a matching <module>.yml file exists in /etc/filebeat/modules.d.

  2. Inspect module configuration files in /etc/filebeat/modules.d. 
    $ sudo ls -1 /etc/filebeat/modules.d | sort
apache.yml.disabled
mysql.yml.disabled
mysqlenterprise.yml.disabled
nginx.yml
system.yml
##### snipped #####

    Use filebeat modules enable and filebeat modules disable to toggle state by renaming between .yml and .yml.disabled.