Migrating from a Deprecated Filebeat Module

If a Filebeat module has been deprecated, there are a few options available for a path forward:

1. Migrate to an Elastic integration, if available. The deprecation notice will link to an appropriate integration, if one exists.

2. Migrate to Elastic Agent for ingesting logs. If a specific integration for the vendor/product does not exist, then one of the custom integrations can be used for ingesting events. A custom pipeline may also be attached to the integration for further processing.

   • CEL Custom API - Collect events from an API using CEL (Common Expression Language)
   • Custom API - Collect events from an API using the HTTPJSON input
   • Custom Google Pub/Sub - Collect events from Google Pub/Sub topics
   • Custom HTTP Endpoint - Collect events from a listening HTTP port
   • Custom Journald - Collect events from journald
   • Custom Kafka - Collect events from a Kafka topic
   • Custom Logs - Collect events from files
   • Custom TCP - Collect events from a listening TCP port
   • Custom UDP - Collect events from a listening UDP port
   • Custom Windows Event - Collect events from a Windows Event Log channel

3. Migrate to a different Filebeat module. In some cases, a Filebeat module may be superseded by a new module. The deprecation notice will link to an appropriate module, if one exists.

4. Use a custom Filebeat input, processors, and ingest pipeline (if necessary).