# Combining ES pipelines: custom and module's ones

**URL:** <https://discuss.elastic.co/t/combining-es-pipelines-custom-and-modules-ones/218858>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [February 11, 2020, 8:09pm UTC](https://discuss.elastic.co/t/combining-es-pipelines-custom-and-modules-ones/218858 "2020-02-11T20:09:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [February 11, 2020, 8:09pm UTC](https://discuss.elastic.co/t/combining-es-pipelines-custom-and-modules-ones/218858/1 "2020-02-11T20:09:13Z")

</div>

I'd like to use a custom pipeline for some logs and collect `system` events - everything by a single Filebeat instance. The question - is the following config "a good way" to do that? I had to configure index names and pipelines for the module `system` explicitly in the ES output:

```auto
output.elasticsearch:
  enabled: true
  hosts: ["192.168.188.21:9200"]
  indices:
  # date suffix will be added in the pipeline
    - index: "ecs-net-7"
      when.equals:
        event.module: "tcpdump"
    - index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
      when.equals:
        event.module: "system"
  pipelines:
    - pipeline: "resolve-ip-and-ports"
      when.equals:
        event.module: "tcpdump"
    - pipeline: "filebeat-%{[agent.version]}-system-syslog-pipeline"
      when.contains:
        log.file.path: "/system"
    - pipeline: "filebeat-%{[agent.version]}-system-auth-pipeline"
      when.contains:
        log.file.path: "/auth"

```

Actually, my expectation was - Filebeat would recognize module's settings (index and pipeline names) automatically, but it wouldn't.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 10, 2020, 8:09pm UTC](https://discuss.elastic.co/t/combining-es-pipelines-custom-and-modules-ones/218858/2 "2020-03-10T20:09:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.