I have created a custom module using
make create-fileset. I've populated the various files, run
make collect, and copied the results into my filebeat module directory. ALMOST everything is working as expected.
When filebeat executes the first time, it loads the ingest pipeline in alphabetical order rather than the order set in the
pipeline.json file*. This causes the grok processor, that needs to be processed first, to execute after the other processors.
Has anyone seen this before? is there a way to force filebeat to respect the ordering in the pipeline.json file when pushing the pipeline to ES?
elastic search & kibana 5.4.1 (via docker-compose up)
filebeat 5.5.0 (installed via brew)
- I've confirmed the pipeline processor ordering is correct in the module's pipeline.json and that filebeat, with debug out, is reading the pipeline and pushing it in alphabetical order.