Can Filebeat load multiple configuration files?

Yes. Keep one main filebeat.yml and use filebeat.config.inputs or filebeat.config.modules to load matching files from separate directories. Input fragments contain lists of inputs; they are not additional complete Filebeat configurations.

Split inputs into a directory

In the main configuration:

filebeat.config.inputs:
  enabled: true
  path: ${path.config}/inputs.d/*.yml
  reload.enabled: true
  reload.period: 10s

filebeat.config.modules:
  path: ${path.config}/modules.d/*.yml

output.elasticsearch:
  hosts: ["http://es:9200"]

The Elasticsearch address is a local example. Use the endpoint, authentication, and TLS settings required by your actual destination.

Create inputs.d/nginx.yml under the configuration directory:

- type: filestream
  id: nginx-access
  paths:
    - /var/log/nginx/access.log

You can place other inputs in inputs.d/app.yml or add another list item to the same file. Each filestream input needs a stable, unique id. Do not repeat the filebeat.inputs or filebeat.config.inputs wrapper inside a fragment.

Understand what reloads

With the input settings above, Filebeat periodically checks matching files and starts or stops the corresponding inputs when their configuration changes. Removing a fragment removes its input from that configuration; this is not a guarantee of instantaneous shutdown or delivery of every pending event.

Live reloading covers external input and module definitions, not the main configuration. The example enables it for inputs only. To reload module files too, add reload.enabled: true and a suitable reload.period under filebeat.config.modules.

Changes to outputs or other main-file settings require the appropriate restart procedure. On POSIX systems, ensure the main file and fragments meet Filebeat's ownership and permission requirements.

Can I pass several main files with -c?

Use -c to select the main configuration and --path.config to set its configuration directory. Use the input/module glob mechanism for the split-file layout shown here; do not rely on repeated -c flags to merge arbitrary main configurations.

Can an input fragment define an output?

No. Keep output settings in the main file. The input loader expects a list of input definitions, and the module loader expects module definitions. Splitting inputs does not give each fragment its own output configuration.

Can two inputs read the same file?

Avoid overlapping paths. Multiple inputs reading the same file can produce duplicate events or other unexpected behavior. Assigning different IDs distinguishes the inputs; it does not make overlapping collection a safe deduplication strategy.

See Elastic's external configuration guide, live reloading documentation, and command reference for details.