# Filebeat and ingest node error

**URL:** <https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [May 9, 2017, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108 "2017-05-09T14:08:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marcello\_A](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcello_a/32/78018_2.png) [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\
**Post date:** [May 9, 2017, 2:08pm UTC](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108/1 "2017-05-09T14:08:41Z")

</div>

Hi All,  
I installed the latest filebeat 5.4.0 on a CentOS 7 server and i tried to parse the auditd file with the specific module and i redirect the output to an elasticsearch 5.4.0 instance. I noticed an error fro filebeat related to the bulk operation and on elasticsearch i recived this exception:

```
 [2017-05-09T16:07:26,508][WARN][r.suppressed] path: /_bulk, params: {}
java.lang.IllegalStateException: There are no ingest nodes in this cluster, unable to forward request to an ingest node.

```

Could you confirm if an ingest node it's required for this module?

Thanks,  
Marcello

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [May 9, 2017, 2:13pm UTC](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108/2 "2017-05-09T14:13:11Z")

</div>

All parsing in filebeat modules is done via ingest node.

---

<div class="post-metadata">

**Author:** ![Marcello\_A](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marcello_a/32/78018_2.png) [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\
**Post date:** [May 10, 2017, 7:33am UTC](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108/3 "2017-05-10T07:33:35Z")

</div>

Thanks for the node it's working now.

Marcello

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2017, 7:36am UTC](https://discuss.elastic.co/t/filebeat-and-ingest-node-error/85108/4 "2017-06-07T07:36:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.