# Filebeat 8.15.0 output to logstash instead of ES, and Kibana dashboard does not display properly

**URL:** <https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 29, 2024, 8:47am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746 "2024-08-29T08:47:11Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![ygqygq2](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ygqygq2/32/137140_2.png) [@ygqygq2](https://discuss.elastic.co/u/ygqygq2)\
**Post date:** [August 29, 2024, 10:16am UTC](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746/5 "2024-08-29T10:16:54Z")

</div>

> [@Aws ingest pipeline error in processor rename "message" to "event.original"](https://discuss.elastic.co/t/aws-ingest-pipeline-error-in-processor-rename-message-to-event-original/341472/8):
>
> But it is an issue for the ingest pipeline. Filebeat modules uses ingest pipelines in Elasticsearch, so it is expected that the original message collected will be sent directly to Elasticsearch. When you add Logstash between filebeat and elasticsearch the original message can change and this can break the ingest pipeline in multiple points. For example, in the [cloudtrail ingest pipeline](https://github.com/elastic/beats/blob/main/x-pack/filebeat/module/aws/cloudtrail/ingest/pipeline.yml), you have this processor in the beginning: - rename: field: "message" target\_field: "event.…

remove `'[event][original]'` can resolve.

```auto
filter {
  if [@metadata][pipeline] {
    ruby {
      code => "event.remove('[event][original]')"
    }
  }
}

```

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-8-15-0-output-to-logstash-instead-of-es-and-kibana-dashboard-does-not-display-properly/365746)._