# Filebeat module ingest logic execution

**URL:** https://discuss.elastic.co/t/filebeat-module-ingest-logic-execution/164122
**Category:** Beats
**Tags:** filebeat
**Created:** [January 14, 2019, 10:18am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-logic-execution/164122 "2019-01-14T10:18:49Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![ep4sh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ep4sh/32/40099_2.png) [@ep4sh](https://discuss.elastic.co/u/ep4sh)
#### Post date: [January 14, 2019, 10:18am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-logic-execution/164122/1 "2019-01-14T10:18:50Z")

</div>

First, im sorry for, probably, stupid q, but it is implicit for me.  
If i configure and run filebeat with some **modules** , will it increase resource consumption on Filebeat Node (current machine) or ES node (remote, in my case)?

I mean that i have "grok / append / rename" and other parsing logic, implemented in my modules (like nginx and my custom modules), so it will be executed on current machine (with filebeat) or on elasticsearch node?

Thanks a lot.

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [January 14, 2019, 10:38am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-logic-execution/164122/2 "2019-01-14T10:38:13Z")

</div>

The parsing logic is implemented as an ingest node pipeline in Elasticsearch, so that is where the processing will take place.

---

<div class="post-metadata">

### Author: ![ep4sh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ep4sh/32/40099_2.png) [@ep4sh](https://discuss.elastic.co/u/ep4sh)
#### Post date: [January 14, 2019, 10:44am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-logic-execution/164122/3 "2019-01-14T10:44:23Z")

</div>

Thanks for your answer!

Yep, man can find some of implemented logic from modules (including custom module) in **processor** list of particular index:  
http://\<ES\_ip\>:9200/\_ingest/pipeline/

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 11, 2019, 10:44am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-logic-execution/164122/4 "2019-02-11T10:44:36Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
