# \[ActiveMq Module\] Problem with ingest pipeline **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 28, 2020, 5:22pm UTC](https://discuss.elastic.co/t/activemq-module-problem-with-ingest-pipeline/216891 "2020-01-28T17:22:54Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![geoffreydjof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geoffreydjof/32/61581_2.png) [@geoffreydjof](https://discuss.elastic.co/u/geoffreydjof)\ **Post date:** [January 28, 2020, 5:22pm UTC](https://discuss.elastic.co/t/activemq-module-problem-with-ingest-pipeline/216891/1 "2020-01-28T17:22:55Z")
Hey ! Sorry for bothering you. I'm quite new in the use of Filebeat but I wanted it to run on a server where ActiveMq is installed. I then installed Filebeat (6.3.0 OSS) and get the ActiveMq module of Activemq. When I enable it and launch Filebeat, I got that error : `2020-01-28T17:17:47.976+0100 DEBUG [modules] fileset/pipelines.go:28 Required processors: [] 2020-01-28T17:17:47.976+0100 ERROR fileset/factory.go:97 Error loading pipeline: Error getting pipeline for fileset activemq/log: Error JSON decoding the pipeline file: ingest/pipeline.yml: invalid character '#' looking for beginning of value ` Which I don't really understand cause the doc says it is possible to have a pipeline in YAML. An anyway, I tried with a JSON but of crouse, I got that mistake `2020-01-28T17:21:41.392+0100 ERROR fileset/factory.go:97 Error loading pipeline: Error getting pipeline for fileset activemq/log: Error reading pipeline file ingest/pipeline.yml: open /appl/wasbivh1/filebeat/share/module/activemq/log/ingest/pipeline.yml: no such file or directory ` Could anyone help me please ? Regards, Jeffrey ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [January 28, 2020, 6:24pm UTC](https://discuss.elastic.co/t/activemq-module-problem-with-ingest-pipeline/216891/2 "2020-01-28T18:24:35Z")
Hi @geoffreydjof, thanks for reposting it here. Quick question, is there a specific reason why you are using 6.3.0 version of Filebeat? We always recommend users to try the latest version (we have 7.5.2 now) to make sure you get all the features and bug fixes 😬 Also could you copy paste your config file here please? Thanks!! ---
**Author:** ![geoffreydjof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geoffreydjof/32/61581_2.png) [@geoffreydjof](https://discuss.elastic.co/u/geoffreydjof)\ **Post date:** [January 28, 2020, 6:47pm UTC](https://discuss.elastic.co/t/activemq-module-problem-with-ingest-pipeline/216891/3 "2020-01-28T18:47:08Z")
Hi @Kaiyan_Sheng I'm using this version of filebeat because in my compagny, the ES version which is used in 6.4... I found a trick which is pretty dirty (and not totally satisfying to be honnest, but I can find now my parsed logs in Kibana). So, as I explained before, the yaml format of the ingest pipeline for ActiveMq module seems to be not recognised : ` Error getting pipeline for fileset activemq/log: Error JSON decoding the pipeline file: ingest/pipeline.yml: invalid character '#' looking for beginning of value` So what I did (which as I said is pretty dirty), is to "put" a Json in the file called "pipeline.yml"... And now it works (almost). So the basic config for pipeline.yml was : --- description: Pipeline for parsing ActiveMQ logs. processors: - grok: field: message pattern\_definitions: GREEDYMULTILINE: "(.|\n|\t)_" NOPIPEGREEDYDATA: "((?! \|).)_" THREAD\_NAME: "((?! \n).)\*" patterns: - "%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}\|%{SPACE}%{LOGLEVEL:log.level}%{SPACE}\|%{SPACE}%{NOPIPEGREEDYDATA:message}%{SPACE}\|%{SPACE}%{NOPIPEGREEDYDATA:activemq.caller}%{SPACE}\|%{SPACE}%{THREAD\_NAME:activemq.thread}%{SPACE}?%{GREEDYMULTILINE:activemq.log.stack\_trace}" ignore\_missing: true - date: if: "ctx.event.timezone == null" field: timestamp target\_field: "@timestamp" formats: ["yyyy-MM-dd HH:mm:ss,SSS"] - date: if: "ctx.event.timezone != null" field: "timestamp" target\_field: "@timestamp" timezone: "{{ event.timezone }}" formats: ["yyyy-MM-dd HH:mm:ss,SSS"] - remove: field: - timestamp on\_failure: - set: field: error.message value: "{{ \_ingest.on\_failure\_message }}" And now, this pipeline.yml file is ``` { "description": "Pipeline for parsing ActiveMQ logs.", "processors": [ { "grok": { "field": "message", "pattern_definitions": { "GREEDYMULTILINE": "(.|\\n|\\t)*", "NOPIPEGREEDYDATA": "((?! \\|).)*", "THREAD_NAME": "((?! \n).)*" }, "patterns": [ "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}\\|%{SPACE}%{LOGLEVEL:log.level}%{SPACE}\\|%{SPACE}%{NOPIPEGREEDYDATA:message}%{SPACE}\\|%{SPACE}%{NOPIPEGREEDYDATA:activemq.caller}%{SPACE}\\|%{SPACE}%{THREAD_NAME:activemq.thread}%{SPACE}?%{GREEDYMULTILINE:activemq.log.stack_trace}" ], "ignore_missing": true } }, { "remove": { "field": [ "timestamp" ] } } ], "on_failure": [ { "set": { "field": "error.message", "value": "{{ _ingest.on_failure_message }}" } } ] } ``` But as you can see, some informations in the json are missing... Regards. ---
**Author:** ![geoffreydjof](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/geoffreydjof/32/61581_2.png) [@geoffreydjof](https://discuss.elastic.co/u/geoffreydjof)\ **Post date:** [February 3, 2020, 7:30pm UTC](https://discuss.elastic.co/t/activemq-module-problem-with-ingest-pipeline/216891/4 "2020-02-03T19:30:10Z")
Hello ! Any One have an idea? Thx in advance ! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 2, 2020, 7:30pm UTC](https://discuss.elastic.co/t/activemq-module-problem-with-ingest-pipeline/216891/5 "2020-03-02T19:30:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.