After reading this post i changed final_pipeline instead of default_pipeline and it worked!
looks like default_pipeline doesn't work if your docs are directly coming from filebeat and it's not a re-index or a watcher index action. hope they add a warning in documents.
1 Like