Filebeat Apache module not showing data on Dashboards when using Logstash

stephenb · November 10, 2022, 11:08pm

@leandrojmp Huh What do you know..

Apache ingest pipeline doesn't tolerate existing "event.original" field

opened 10:09AM - 01 Jun 22 UTC

From the apache ingest pipeline ([link](https://github.com/elastic/integrations/…blob/main/packages/apache/data_stream/access/elasticsearch/ingest_pipeline/default.yml#L13-L15)): ```yaml - rename: field: message target_field: event.original ``` The rename processor documentation states: > If the field doesn’t exist or the new name is already used, an exception will be thrown. This means that any document that already has an "event.original" field (with or without a "message") field will cause an ingestion error: ```json "message": "......", "error": { "message": "field [event.original] already exists" }, ``` A suggestion is to tolerate the presence of "event.original" and "message" fields by including an `if` condition in the rename processor.

Known issue this plus a couple internals etc.. .not sure when it will get fix... its one of those accross teams issue

Topic		Replies	Views
Data from Filebeat Not Showing in Elastic Beats filebeat	2	239	April 4, 2023
No results found for none of filebeat modules in Kibana Dashboard Beats filebeat	6	1755	January 11, 2018
Importing Apache logs with FIlebeats tutorial doesn't work Beats filebeat	11	506	March 27, 2020
Filebeat and apache2 module Beats filebeat	3	1637	June 12, 2017
Apache2 module \| Filebeat - No results found Beats filebeat	7	2670	April 8, 2018

Filebeat Apache module not showing data on Dashboards when using Logstash

Related Topics