Create pipeline for module

Elastic Stack Beats
1

I've enabled the filebeat system module:

filebeat modules enable system
filebeat setup --pipelines --modules system
filebeat setup --dashboards
systemctl restart filebeat

This is what logstash has to say

pipeline with id [filebeat-7.9.0-system-auth-pipeline] does not exist

This is the part of logstash that is responsible for it:

output {
    if [@metadata][pipeline] {
        elasticsearch {
            hosts => "https://localhost:9200"
            manage_template => false
            cacert => "/etc/elasticsearch/estackcap12extract.crt"
            ssl => true
            ssl_certificate_verification => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
            pipeline => "%{[@metadata][pipeline]}"
            user => "elastic"
            password => "*secret*"
        }
    } else {
    ...

Do I need to manually create a pipeline for this? Did I do something wrong? Best I could find is this doc page page but it seem to be for custom things and this is a ready module so I'm not sure how relevant it is.

2

Did the suggestions here help - https://www.reddit.com/r/elasticsearch/comments/jvq2yq/create_pipeline_for_filebeat/?

3

I want to try out u/WontFixYourComputer's suggestion to " tell filebeat to setup a pipeline with Logstash in the middle". Hoping to get a reply from him on how to do it.

1 Like
4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.