# Azure Filebeats Module
**URL:** https://discuss.elastic.co/t/azure-filebeats-module/299878
**Category:** Beats
**Tags:** filebeat
**Created:** [March 16, 2022, 3:50pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878 "2022-03-16T15:50:35Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@tman5](https://discuss.elastic.co/u/tman5)
#### Post date: [March 16, 2022, 3:50pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878/1 "2022-03-16T15:50:36Z")
We're looking to configure [Azure module | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-module-azure.html) and I had a question.
Our filebeats is outputing to logstash which then in turn writes out to Graylog. I have filebeat setup to gather logs from an Azure eventhub and the logs are being gathered, but the parsing doesn't seem to be happening. The message field in Graylog contains all the fields from Azure but not parsed out.
Is this because filebeat isn't using an elastic pipeline to parse events?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 16, 2022, 4:28pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878/2 "2022-03-16T16:28:42Z")
The parsing is done in Elasticsearch, it uses an ingest pipeline.
If you are sending to Logstash, you need to configure your logstash output to use the ingest pipeline in Elasticsearch, you can do that adding the option `pipeline => "pipeline-name"` in your Elasticsearch output.
---
### Author:  [@tman5](https://discuss.elastic.co/u/tman5)
#### Post date: [March 16, 2022, 4:59pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878/3 "2022-03-16T16:59:01Z")
Thanks. What if the logstash sends out through the gelf format and not directly to Elasticsearch?
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [March 16, 2022, 6:03pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878/4 "2022-03-16T18:03:21Z")
I don't understand your last question, can you give more context?
Send what to where in the Gelf format?
---
### Author:  [@tman5](https://discuss.elastic.co/u/tman5)
#### Post date: [March 16, 2022, 6:06pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878/5 "2022-03-16T18:06:44Z")
In our flow we don't have Elasticsearch output in the mix:
filebeat -\> logstash - Graylog (out\_gelf)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 13, 2022, 8:07pm UTC](https://discuss.elastic.co/t/azure-filebeats-module/299878/6 "2022-04-13T20:07:03Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.