# Filebeat module ingest pipeline not working in logstash **URL:** \ **Category:** Logstash\ **Created:** [July 17, 2023, 5:44am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500 "2023-07-17T05:44:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![nbindal](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@nbindal](https://discuss.elastic.co/u/nbindal)\ **Post date:** [July 17, 2023, 5:44am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500/1 "2023-07-17T05:44:11Z")
Hi Team, I am using apache module and fileset in Beats+ELK stack where Filebeat is sending logs to logstash, logstash is using Ingest pipeline(we get module ingest pipeline - filebeat-8.7.1-apache-access-pipeline) , but it is somehow not utilizing the pipeline when ingesting data into elasticsearch. The same ingest pipeline works perfectly when I use filebeat directly to elasticsearch but not when logstash is used in between. Expectation: Data plugin/geoip/useragent plugins should be applied to the data which is part of ingest pipeline. The \_simulate api gives the expeted output but not via logstash. ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/b/8bc39606415af0923ceb993abb3bb2841cf78f24.png) Versions: Whole ELK + Beats is on version 8.7.1c ---
**Author:** ![nbindal](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@nbindal](https://discuss.elastic.co/u/nbindal)\ **Post date:** [July 17, 2023, 5:51am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500/2 "2023-07-17T05:51:35Z")
Expected output - 30th may 2014 - When pushing data directly from filebeat (Uses elasticsearch as output in filebeat.yml) ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/8/58d05f1db3ac8dd1ab9994782011de9c68b9ca6f.png) ---
**Author:** ![nbindal](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@nbindal](https://discuss.elastic.co/u/nbindal)\ **Post date:** [July 17, 2023, 5:52am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500/3 "2023-07-17T05:52:36Z")
Filebeat.yml - ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/0/00d373cfa4250c98f3613468abb9cec06d5e48ca.png) ---
**Author:** ![nbindal](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@nbindal](https://discuss.elastic.co/u/nbindal)\ **Post date:** [July 17, 2023, 5:53am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500/4 "2023-07-17T05:53:16Z")
Logstash logs: Data is coming to logstash, and I can see pipeline name is also mentioned, but it is not being utilized in Elasticsearch- No geoip or user agent filter got applied ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/f/af06b0b71cabe71b84230bf77bfc02b517ce2085.png) ---
**Author:** ![nbindal](https://avatars.discourse-cdn.com/v4/letter/n/ecd19e/32.png) [@nbindal](https://discuss.elastic.co/u/nbindal)\ **Post date:** [July 17, 2023, 5:55am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500/5 "2023-07-17T05:55:43Z")
Kibana output: Faulty output - 17th july data is coming from filebeat--\>logstash-\>elasticsearch Exppected output - 30th may 2014 - data is pushed directly through filebeat(with output set to elasticsearch and pipeline name mentioned in filebeat.yml) ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/8/58d05f1db3ac8dd1ab9994782011de9c68b9ca6f.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 14, 2023, 5:55am UTC](https://discuss.elastic.co/t/filebeat-module-ingest-pipeline-not-working-in-logstash/338500/6 "2023-08-14T05:55:58Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.