# Filebeat Apache module not showing data on Dashboards when using Logstash

**URL:** <https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594>\
**Category:** Elasticsearch\
**Created:** [November 9, 2022, 10:43pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594 "2022-11-09T22:43:19Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [November 10, 2022, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594/8 "2022-11-10T21:56:19Z")

</div>

> [@stephenb](#):
>
> I don't know if this is a broad bug or something intentionally changed.

If I'm not wrong, this is a [breaking change](https://www.elastic.co/guide/en/logstash/current/logstash-8-0-0.html#breaking-8.0.0) in 8.X related to ecs fields.

From 8.0 the `pipeline.ecs_compatibility` setting is on by default, so Logstash will output ecs fields and in this case the `event.original` field is created, in version 7.X the `pipeline.ecs_compatibility` setting was `disabled` by default.

For example, if you test the following pipeline in Logstash:

```auto
input {
    stdin {}
}
output {
    stdout {}
}

```

And you set `pipeline.ecs_compatibility: v8` in `logstash.yml`

and you run:

```auto
echo "sample message" | /opt/logstash/bin/logstash --path.settings /opt/logstash/config -f /opt/logstash/pipelines/config.conf

```

You will get this output:

```auto
{
         "event" => {
        "original" => "sample message"
    },
       "message" => "sample message",
          "host" => {
        "hostname" => "server"
    },
      "@version" => "1",
    "@timestamp" => 2022-11-10T21:46:56.615Z
}

```

If you set `pipeline.ecs_compatibility` as `disabled` you get this output:

```auto
{
      "@version" => "1",
       "message" => "sample message",
          "host" => "server",
    "@timestamp" => 2022-11-10T21:50:08.861Z
}

```

So if someone is using Logstash with Filebeat or Elastic Agent modules and Elasticsearch Ingest pipelines, they may have some issues because some of those pipelines will try to copy `message` into `event.original`, which may already exist.

I think that this [proposed change](https://discuss.elastic.co/t/logstash-8-x-ecs-compatibility-mode-adds-event-original/307654) to use `@metadata.original` instead of `event.original` would be better.

---

_[View the full topic](https://discuss.elastic.co/t/filebeat-apache-module-not-showing-data-on-dashboards-when-using-logstash/318594)._