Filebeat modules simplify the collection, parsing, and visualization of common log formats. More info at https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-modules-overview.html. Some modules are part of x-pack, but some are not. Ebuild currently does not install any modules, but they are there in the filebeat-7.2.0.tar.gz archive. beats-7.2.0/filebeat/modules.d directory should go into /etc/filebeat/ beats-7.2.0/module should go into /var/lib/filebeat This also gets rid of startup error of filebeat: 2019-09-03T18:56:46.614-0700 ERROR fileset/modules.go:125 Not loading modules. Module directory not found: /var/lib/filebeat/module