# Config for ingest pipeline from Filebeat

**URL:** https://discuss.elastic.co/t/config-for-ingest-pipeline-from-filebeat/190874
**Category:** Logstash
**Tags:** beats-module
**Created:** [July 17, 2019, 5:27am UTC](https://discuss.elastic.co/t/config-for-ingest-pipeline-from-filebeat/190874 "2019-07-17T05:27:10Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![smerzlyakov](https://avatars.discourse-cdn.com/v4/letter/s/db5fbb/32.png) [@smerzlyakov](https://discuss.elastic.co/u/smerzlyakov)
#### Post date: [July 17, 2019, 5:27am UTC](https://discuss.elastic.co/t/config-for-ingest-pipeline-from-filebeat/190874/1 "2019-07-17T05:27:10Z")

</div>

Hello. I have a problem with ingest pipeline best practicies.  
I want to parse system logs by Filebeat pipeline, but do not use Filebeat, because we already collect these logs.  
I do ./filebeat setup --pipelines for inserting pipeline in ELK.  
Then i use such config, that support provide me. Is this a best way? I have some mapping errors, that's why i want to check config first. Pipeline name and all network adresses are correct, i check it. I have events, but have a mapping errors.

```
input {
  udp {
    port => 10002
    codec => line
    tags => ["linux_sys_secure"]
  }
}

filter {
  if "linux_secure" in [tags]{
    mutate {
      add_field => { "[@metadata][pipeline]" => "filebeat-7.2.0-system-syslog-pipeline" }
    }
  }
}

output {
  if "linux_secure" in [tags]{
    elasticsearch {
      pipeline => "%{[@metadata][pipeline]}"
      hosts => ["skynet-elk-1:9200"]
      index => 'filebeat-linux_sys_secure-11-%{+YYYY.MM.dd}'
    }
  }
}
```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 14, 2019, 5:34am UTC](https://discuss.elastic.co/t/config-for-ingest-pipeline-from-filebeat/190874/2 "2019-08-14T05:34:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.