# Beat -\> Logstash -\> Elasticsearch configuration problem

**URL:** <https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801>\
**Category:** Beats\
**Tags:** metricbeat\
**Created:** [December 8, 2022, 2:54pm UTC](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801 "2022-12-08T14:54:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rysiu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rysiu/32/61919_2.png) [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Post date:** [December 8, 2022, 2:54pm UTC](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801/1 "2022-12-08T14:54:58Z")

</div>

I have a problem with the data flow configuration:

**Beat -\> Logstash -\> Elasticsearch**

I initially configured everything in the flow:

**Beat -\> Elasticsearch**

of course I initially did the required setup (adding standard visualizations/dashboards/templates, etc.).

When, for example, Metricbeat sent data directly to Elasticsearch everything worked OK.

In Kibana, for example, in Inventory/Metrics I can see the information regarding the nodes where Metricbeat is. Everything is ok.

However, when changing the flow with additionally Logstash, not everything works ok for me.

In Metricbeat, I changed the output from elasticsearch to logstash (to logstash per port).

In Logstash, however, I added a pipeline (input beat and output elasticsearch).

Below is the pipeline configuration in Logstash:

```auto
input {
  beats {
    port => 5045
  }
}

output {
    elasticsearch {
        hosts => ["https://D-ELK1:9200", "https://D-ELK2:9200", "https://D-ELK3:9200"]
        cacert => "/etc/logstash/certs/ca.crt"
        user => "elastic"
        password => "xxxx"
        # index => ".ds-metricbeat-8.3.2-logstash-%{+YYYY.MM}"
        index => "metricbeat-8.3.2-%{+YYYY.MM}"
        # index => "%{[@metadata][beat]}-%{[@metadata][version]}"
        # template_name => "metricbeat-8.3.2"
        # template_overwrite => false
        # data_stream => true
  }
}

```

Some of the fields commented but I also tried with them (when they were uncommented).

Logstash and Metricbeat services are working (active).  
I don't see any big errors in the logs.

I don't see the information displayed in Inventory/Metrics.

On the other hand, I can see in Discovery that data from this node (from Metricbeat) is available.

Why am I not seeing the data in Inventory/Metrics?

 ![obraz](https://us1.discourse-cdn.com/elastic/original/3X/a/6/a658ad96971d28a233e9bd6956969c919a0e3c28.png)

By default, Beats sends data to Elatsicsearch and this is processed in a data stream.

I don't know exactly what it looks like when I do it through the pipeline in Logstash.

How should I configure the elasticsearch output in Logstash pipeline for beats agents so that this is handled well?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 9, 2022, 3:18pm UTC](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801/2 "2022-12-09T15:18:40Z")

</div>

Perhaps Look at the example on this page

> **[Use ingest pipelines for parsing | Logstash Reference \[8.5\] | Elastic](https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 6, 2023, 5:18pm UTC](https://discuss.elastic.co/t/beat-logstash-elasticsearch-configuration-problem/320801/3 "2023-01-06T17:18:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.