Hi @JamblaInc Welcome to the community.
There is a little subtle magic to this I think... the default pipeline is used and overrides what you are specifying in the elasticsearch output, I believe you will need to define it in the input sections
So first are you using the the AWS Module and / or the AWS Cloudwatch Input or both?
If you are using the AWS CloudWatch input you would specify it there
See pipeline ... and I think the magic there is actually a default value for it and then if you read the little section below it says
The pipeline ID can also be configured in the Elasticsearch output, but this option usually results in simpler configuration files. If the pipeline is configured both in the input and output, the option from the input is used.
Which means the default pipeline will always override the output section.
This may not be it but take a look let me us know...
There was a similar discuss a while back...