Filebeat Apache module not showing data on Dashboards when using Logstash

stephenb · November 10, 2022, 11:08pm

@leandrojmp Huh What do you know..

Apache ingest pipeline doesn't tolerate existing "event.original" field

opened 10:09AM - 01 Jun 22 UTC

From the apache ingest pipeline ([link](https://github.com/elastic/integrations/…blob/main/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml#L13-L15)): ```yaml - rename: field: message target_field: event.original ``` The rename processor documentation states: > If the field doesn’t exist or the new name is already used, an exception will be thrown. This means that any document that already has an "event.original" field (with or without a "message") field will cause an ingestion error: ```json "message": "......", "error": { "message": "field [event.original] already exists" }, ``` A suggestion is to tolerate the presence of "event.original" and "message" fields by including an `if` condition in the rename processor.

Known issue this plus a couple internals etc.. .not sure when it will get fix... its one of those accross teams issue