Filebeat module ingest logic execution

Elastic Stack Beats
1

First, im sorry for, probably, stupid q, but it is implicit for me.
If i configure and run filebeat with some modules , will it increase resource consumption on Filebeat Node (current machine) or ES node (remote, in my case)?

I mean that i have "grok / append / rename" and other parsing logic, implemented in my modules (like nginx and my custom modules), so it will be executed on current machine (with filebeat) or on elasticsearch node?

Thanks a lot.

2

The parsing logic is implemented as an ingest node pipeline in Elasticsearch, so that is where the processing will take place.

1 Like
3

Thanks for your answer!

Yep, man can find some of implemented logic from modules (including custom module) in processor list of particular index:
http://<ES_ip>:9200/_ingest/pipeline/

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.