# Deleted ingest pipeline, doh! - Can't get it Back **URL:** \ **Category:** Beats\ **Tags:** elastic-agent\ **Created:** [August 6, 2021, 9:46pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687 "2021-08-06T21:46:14Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Post date:** [August 6, 2021, 9:46pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/1 "2021-08-06T21:46:14Z")
Hey there, I configured Fleet in the console, installed/enrolled an agent down on my server and configured an integration.. Moments later i got logs and kibana was happy. I'm an idiot and accidently deleted the ingest pipeline in Kibana and the logs are now going unstructured into logs-elastic\_agent.filebeat. I read that Fleet automatically installs the ingest pipelines when it first deploys a module to an agent, so i removed and re-added the agent, however i don't think it is re-installing the pipeline. I looked for the pipeline json, but in official elastic github, can only find the yaml versions. What can i do? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 6, 2021, 10:07pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/2 "2021-08-06T22:07:22Z")
@ajhstn Yes Doh! but we all Doh! Did you try to remove the integration from the policy ... apply it, let it all come back up. Then re-add the integration to the policy and apply it? Curious... Which integration? ---
**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Post date:** [August 6, 2021, 10:10pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/3 "2021-08-06T22:10:42Z")
Hi @stephenb yes, i have uninstalled the agent, reinstalled it, removed the integration and reconfigured it, applied it, unapplied it.. The Palo Alto integration. It has worked since i first installed, so i know it works.. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 6, 2021, 10:20pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/4 "2021-08-06T22:20:34Z")
Hmmmm.... Something besides the obvious seems a bit wrong it should be failing with a missing pipeline I would think (unless we added some safety logic for that). What version are you on? Do have the exact name of the pipeline that you deleted? You could try installing the agent on another box? I updated your Subject Line perhaps an agent specialist will chime in. It probably thinks that integration is correctly installed.... ---
**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Post date:** [August 6, 2021, 10:24pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/5 "2021-08-06T22:24:02Z")
I'll try a full integration remove, then apply, then uninstall, then hard delete /opt/Elastic on disk, then reboot, then re-install new agent. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 6, 2021, 10:26pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/6 "2021-08-06T22:26:11Z")
What version are you on. I can easily load the ingest pipeline and get it to you to help get you stable. Then we can figure out what went wrong later. ---
**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Post date:** [August 6, 2021, 10:30pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/7 "2021-08-06T22:30:48Z")
7.10 - but im going to upgrade to 7.14. I found this in `/opt/Elastic/Agent/data/elastic-agent-1428d5/logs/default/filebeat-json.log` i am unsure if it is relevant. `{"log.level":"debug","@timestamp":"2021-08-07T08:27:16.214+1000","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":128},"message":"Fail to apply processor client{add_index_pattern=logs-panw.panos-default` ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 6, 2021, 10:32pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/8 "2021-08-06T22:32:39Z")
Yeah 7.10 ... Looong ago early early agent.... I would get to 7.14 and then try. I will get the 7.10 ingest pipeline as a back up ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 6, 2021, 10:37pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/9 "2021-08-06T22:37:45Z")
@ajhstn _Exactly_ which version 7.10.2? Also that does NOT look like a good error... did you touch any of the agent side ingest / processors? Although OTH that is probably because the index pattern is already there... so maybe not so bad... hard to tell.. ---
**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Post date:** [August 6, 2021, 10:41pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/10 "2021-08-06T22:41:38Z")
It is 7.10.0 specifically, but i am moving it up to 7.14.0 as we speak. I haven't touched anything on agent side, except for default install procedures. ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [August 6, 2021, 10:46pm UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/11 "2021-08-06T22:46:25Z")
Give that a Clean Whirl... see how it goes, stepping away! [Here](https://gist.github.com/bvader/fc316eabf2ac6ca2b62e3ed705b39da2) is the gist with `_ingest/pipeline/filebeat-7.10.0-panw-panos-pipeline` For clarity you don't really want your agent version to be ahead of your Elasticsearch Version See order [here](https://www.elastic.co/guide/en/elastic-stack/current/upgrading-elastic-stack.html#upgrade-order-elastic-stack) ---
**Author:** ![ajhstn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ajhstn/32/24629_2.png) [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Post date:** [August 7, 2021, 8:27am UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/12 "2021-08-07T08:27:52Z")
Hi @stephenb thanks for your help today. I upgraded the cluster to 7.14.0, reinstalled everything and it IS gettting data into Elasticsearch. There is now a Grok error.. but i'll raise a new ticket for that. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 4, 2021, 10:28am UTC](https://discuss.elastic.co/t/deleted-ingest-pipeline-doh-cant-get-it-back/280687/13 "2021-09-04T10:28:01Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.