# Filebeat & ingest pipelines
**URL:** https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515
**Category:** Beats
**Tags:** filebeat
**Created:** [February 16, 2020, 11:56am UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515 "2020-02-16T11:56:38Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@StefanoM](https://discuss.elastic.co/u/StefanoM)
#### Post date: [February 16, 2020, 11:56am UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515/1 "2020-02-16T11:56:38Z")
Hi there,
is it correct to say that you only need to load an ingest pipeline (e.g. filebeat setup --pipelines --modules system,nginx,mysql) when you are using elasticsearch ingest node as output? Or do also need to do this if you are only using the logstash outpt?
Thanks and kind regards!
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [February 16, 2020, 10:05pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515/2 "2020-02-16T22:05:31Z")
No, you don't need ingest pipelines unless you are going to use them 🙂
Technically, logstash can direct output to an Elasticsearch pipeline with the "pipeline" parameter, so this reads a little like a trick exam question 🙂
---
### Author:  [@StefanoM](https://discuss.elastic.co/u/StefanoM)
#### Post date: [February 17, 2020, 6:39pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515/3 "2020-02-17T18:39:38Z")
Hi there,
thanks for the answer. To what logstash pipeline parameter are you referring to?
([https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html](https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html))
Would you mind give me a quick example?
Thank you very much and kind regards
Stefano (Metronom - METRO IT)
---
### Author:  [@rugenl](https://discuss.elastic.co/u/rugenl)
#### Post date: [February 17, 2020, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515/4 "2020-02-17T21:11:11Z")
The "pipeline =\>" in the example below. This is an ansible template, so {{ fields }} aren't filled in at this point. This is how I send filebeat module events that need ingest pipeline processing from logstash to elastic in the same pipe as events that don't need ingest processing.
```
....
else if "use_ingest" in [tags] and [fileset][module] {
elasticsearch {
hosts => [{{ ES_http }}]
cacert => "/..../certs/https_interm.cer"
user => "{{ elastic.user }}"
password => "{{elastic.pass }}"
sniffing => false
manage_template => false
pipeline => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[fileset][module]}-%{[fileset][name]}-pipeline"
ilm_enabled => true
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{[fields][app_id]}-%{[fields][campus]}"
}
....
```
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [February 19, 2020, 3:11pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515/5 "2020-02-19T15:11:59Z")
Hi @StefanoM and @rugenl,
There are two separate things to think about here:
1. Loading ingest pipelines, and
2. Referencing the loaded ingest pipelines.
This documentation page explains the difference between these two in detail: [https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html#use-ingest-pipelines](https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html#use-ingest-pipelines).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 18, 2020, 3:12pm UTC](https://discuss.elastic.co/t/filebeat-ingest-pipelines/219515/6 "2020-03-18T15:12:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.