Filebeat Apache module not showing data on Dashboards when using Logstash

stephenb · November 10, 2022, 11:08pm

@leandrojmp Huh What do you know..

Apache ingest pipeline doesn't tolerate existing "event.original" field

opened 10:09AM - 01 Jun 22 UTC

From the apache ingest pipeline ([link](https://github.com/elastic/integrations/…blob/main/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml#L13-L15)): ```yaml - rename: field: message target_field: event.original ``` The rename processor documentation states: > If the field doesn’t exist or the new name is already used, an exception will be thrown. This means that any document that already has an "event.original" field (with or without a "message") field will cause an ingestion error: ```json "message": "......", "error": { "message": "field [event.original] already exists" }, ``` A suggestion is to tolerate the presence of "event.original" and "message" fields by including an `if` condition in the rename processor.

Known issue this plus a couple internals etc.. .not sure when it will get fix... its one of those accross teams issue

Topic		Replies	Views
Data from Filebeat Not Showing in Elastic Beats filebeat	2	239	April 4, 2023
Using Filebeat modules and logstash conf Beats filebeat	1	368	January 15, 2020
Cant get apache module working Beats filebeat	3	1275	January 24, 2018
Can't load modules Beats filebeat	3	560	October 1, 2020
Unable to see data into Apache's Default Dashboard with filebeat which is sending data to logstash Logstash	4	297	June 9, 2020

Filebeat Apache module not showing data on Dashboards when using Logstash

Related topics