# Beats Data not enriching when using Logstash + Elastic output plugin

**URL:** <https://discuss.elastic.co/t/beats-data-not-enriching-when-using-logstash-elastic-output-plugin/229283>\
**Category:** Elasticsearch\
**Created:** [April 22, 2020, 2:43pm UTC](https://discuss.elastic.co/t/beats-data-not-enriching-when-using-logstash-elastic-output-plugin/229283 "2020-04-22T14:43:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgevans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mgevans/32/66790_2.png) [@mgevans](https://discuss.elastic.co/u/mgevans)\
**Post date:** [April 22, 2020, 2:43pm UTC](https://discuss.elastic.co/t/beats-data-not-enriching-when-using-logstash-elastic-output-plugin/229283/1 "2020-04-22T14:43:55Z")

</div>

Hi Folks,  
This is a fairly basic question so i'm sure i'm missing something straightforward.  
We are using out of the box everything in a brand new POC environment.

I have created an enrichment policy and associated pipeline that works great when i run data through the ingest node locally in Elasticsearch (via dev console). \*pipeline details below

Example of success with enrichment pipeline

```auto
POST metricbeat-7.6.2-2020.04.13/_update_by_query?pipeline=pipeline_appcmdb_host_application&wait_for_completion=false 

```

Works great! I can see our enrichment data fields populated based on the matching fields

```auto
POST metricbeat-7.6.2-2020.04.21/_doc?pipeline=pipeline_appcmdb_host_application 
{doc data here}

```

This also works just fine.

We have beats 7.6.x running and sending to Logstash. Logstash in turn sends to Elastic via the Elasticsearch Output Plugin ([https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-pipeline](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-pipeline))

I'm trying to put our logstash sent data through the same pipeline but we are not getting any enrichment. The tag associated with the pipeline is not being added either suggesting it isn't even trying the pipeline.

here is our Logstash pipeline definition which includes the Elasticsearch plugin with the target pipeline defined.

```auto
    # MonitorDevPipe-1 Logstash configuration 
    # Beats -> Logstash -> Elasticsearch pipeline.

    input {
      beats {
        port => 5044
      }
    }

    output {
      elasticsearch {
        hosts => ["http://gtselkdev01:9200"]
        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    	pipeline => "pipeline_appcmdb_host_application"
      }
    }

```

Thanks for any help!  
Michael

**pipeline details**

```auto
    PUT _ingest/pipeline/pipeline_appcmdb_host_application
    {
      "description" : "adds application name to incoming beats data based on beats agent host name",
      "processors" : [
        {
          "enrich": {
              "policy_name": "enrich_appcmdb_host_application",
              "field": "host.hostname",
              "target_field": "appcmdb_application",
              "ignore_missing": true,
              "tag": "enrich_appcmdb_host_application"
          }
        }
      ]
    }

```

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 3, 2020, 8:49am UTC](https://discuss.elastic.co/t/beats-data-not-enriching-when-using-logstash-elastic-output-plugin/229283/3 "2020-05-03T08:49:04Z")

</div>

What does an event that is not getting enriched by the pipeline look like?

---

<div class="post-metadata">

**Author:** ![mgevans](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mgevans/32/66790_2.png) [@mgevans](https://discuss.elastic.co/u/mgevans)\
**Post date:** [May 4, 2020, 8:22pm UTC](https://discuss.elastic.co/t/beats-data-not-enriching-when-using-logstash-elastic-output-plugin/229283/5 "2020-05-04T20:22:36Z")

</div>

OK - so this was a simple solution. The Logstash config was not pointing to the right pipeline .CONF file. Everything worked when i pointed it to the right file. Amazing how that works

Anyhow thanks a bunch to our local Elastic sales engineer for spending time and identifying this one for me. Shout out at @Michael\_Mulcahy.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 1, 2020, 8:22pm UTC](https://discuss.elastic.co/t/beats-data-not-enriching-when-using-logstash-elastic-output-plugin/229283/6 "2020-06-01T20:22:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.