# Behavior of a deleted pipeline
**URL:** https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213
**Category:** Elasticsearch
**Created:** [February 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213 "2020-02-13T13:47:12Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Cuju](https://discuss.elastic.co/u/Cuju)
#### Post date: [February 13, 2020, 1:47pm UTC](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213/1 "2020-02-13T13:47:12Z")
Hello,
I had to delete and reinstall Filebeat because of some things I did wrong. In the old configuration I had, it gave me some available fields which are also in the new old, even if the pipeline doesn't exist (like host.hostname).
Alongside, when I `PUT /_ingest/pipeline/filebeat-7.5.2-system-syslog-pipeline`, the old pipeline, it doesn't give me anything even if it worked perfectly on the old one.
Do you know why and how to resolve it ? Thanks a lot.
---
### Author:  [@Cuju](https://discuss.elastic.co/u/Cuju)
#### Post date: [February 13, 2020, 1:49pm UTC](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213/2 "2020-02-13T13:49:23Z")
Here is the pipeline I talk about and it was unchanged :
```
PUT /_ingest/pipeline/filebeat-7.5.2-system-syslog-pipeline
{
"description": "Pipeline for parsing Syslog messages.",
"processors": [
{
"grok": {
"pattern_definitions": {
"GREEDYMULTILINE": "(.|)*"
},
"ignore_missing": true,
"field": "message",
"patterns": [
"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\\[%{POSINT:process.pid:long}\\])?: %{GREEDYMULTILINE:system.syslog.message}",
"%{TIMESTAMP_ISO8601:system.syslog.timestamp} %{SYSLOGHOST:host.hostname} %{DATA:process.name}(?:\\[%{POSINT:process.pid:long}\\])?: %{GREEDYMULTILINE:system.syslog.message}",
"%{SYSLOGTIMESTAMP:system.syslog.timestamp} %{GREEDYMULTILINE:system.syslog.message}"
]
}
},
{
"rename": {
"field": "system.syslog.message",
"target_field": "message",
"ignore_missing": true
}
},
{
"date": {
"formats": [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"MMM d HH:mm:ss",
"ISO8601"
],
"on_failure": [
{
"append": {
"field": "error.message",
"value": "{{ _ingest.on_failure_message }}"
}
}
],
"if": "ctx.event.timezone == null",
"field": "system.syslog.timestamp",
"target_field": "@timestamp"
}
},
{
"date": {
"if": "ctx.event.timezone != null",
"field": "system.syslog.timestamp",
"target_field": "@timestamp",
"formats": [
"MMM d HH:mm:ss",
"MMM dd HH:mm:ss",
"MMM d HH:mm:ss",
"ISO8601"
],
"timezone": "{{ event.timezone }}",
"on_failure": [
{
"append": {
"field": "error.message",
"value": "{{ _ingest.on_failure_message }}"
}
}
]
}
},
{
"remove": {
"field": "system.syslog.timestamp"
}
}
],
"on_failure": [
{
"set": {
"field": "error.message",
"value": "{{ _ingest.on_failure_message }}"
}
}
]
}
```
---
### Author:  [@Cuju](https://discuss.elastic.co/u/Cuju)
#### Post date: [February 14, 2020, 2:54pm UTC](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213/3 "2020-02-14T14:54:43Z")
I finally fix it.
Actually, I update FIlebeat but it was still looking at the 7.5 version instead of the 7.6. A directory for the 7.6 version was created, but not on the `/etc/filebeat/` so I had to move the files to take over the old one.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 13, 2020, 2:54pm UTC](https://discuss.elastic.co/t/behavior-of-a-deleted-pipeline/219213/4 "2020-03-13T14:54:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.