Filebeat module ingest logic execution


(Ep4sh) #1

First, im sorry for, probably, stupid q, but it is implicit for me.
If i configure and run filebeat with some modules , will it increase resource consumption on Filebeat Node (current machine) or ES node (remote, in my case)?

I mean that i have "grok / append / rename" and other parsing logic, implemented in my modules (like nginx and my custom modules), so it will be executed on current machine (with filebeat) or on elasticsearch node?

Thanks a lot.


(Christian Dahlqvist) #2

The parsing logic is implemented as an ingest node pipeline in Elasticsearch, so that is where the processing will take place.


(Ep4sh) #3

Thanks for your answer!

Yep, man can find some of implemented logic from modules (including custom module) in processor list of particular index:
http://<ES_ip>:9200/_ingest/pipeline/


(system) closed #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.