Filebeat 8.15.0 output to logstash instead of ES, and Kibana dashboard does not display properly

[ygqygq2 (Chinge Yang)]

Aws ingest pipeline error in processor rename "message" to "event.original"

But it is an issue for the ingest pipeline. Filebeat modules uses ingest pipelines in Elasticsearch, so it is expected that the original message collected will be sent directly to Elasticsearch. When you add Logstash between filebeat and elasticsearch the original message can change and this can break the ingest pipeline in multiple points. For example, in the cloudtrail ingest pipeline, you have this processor in the beginning: - rename: field: "message" target_field: "event.…

remove '[event][original]' can resolve.

filter {
  if [@metadata][pipeline] {
    ruby {
      code => "event.remove('[event][original]')"
    }
  }
}