# Filebeat nginx module does not work with AWS ES **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 4, 2019, 3:12am UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449 "2019-12-04T03:12:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![john\_eapen](https://avatars.discourse-cdn.com/v4/letter/j/b3f665/32.png) [@john\_eapen](https://discuss.elastic.co/u/john_eapen)\ **Post date:** [December 4, 2019, 3:12am UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/1 "2019-12-04T03:12:56Z")
Filebeat nginx module does not work with AWS ES due to lack of support for ingest-geoip plugin in AWS ES. Is there any temporary workaround for this issue ? I don't need the geoip information for now. Also any update on [https://github.com/elastic/beats/issues/10867](https://github.com/elastic/beats/issues/10867) ? Thanks John ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [December 5, 2019, 9:31pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/2 "2019-12-05T21:31:12Z")
Hi @john_eapen, the github issue still under discussion. We will update it with conclusion. Meantime, maybe you can disable geoip manually by removing the processor in [https://github.com/elastic/beats/blob/master/filebeat/module/nginx/access/ingest/default.json#L126](https://github.com/elastic/beats/blob/master/filebeat/module/nginx/access/ingest/default.json#L126) and rebuild filebeat binary. ---
**Author:** ![john\_eapen](https://avatars.discourse-cdn.com/v4/letter/j/b3f665/32.png) [@john\_eapen](https://discuss.elastic.co/u/john_eapen)\ **Post date:** [December 6, 2019, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/3 "2019-12-06T16:23:47Z")
Hi Kaiyan, Thanks for you reply. But this did not work for me. Can you tell me if the following is supposed to work or am I missing something? We use docker/kubernetes. Instead of rebuilding the entire binary, i adjusted the Dockerfile as follows to include the modified "nginx/access/ingest/default.json" where i removed all references to geoip processor. > cat docker/Dockerfile > FROM [docker.elastic.co/beats/filebeat-oss:7.4.1](http://docker.elastic.co/beats/filebeat-oss:7.4.1) > COPY fields.yml /usr/share/filebeat/fields.yml > COPY module/nginx/access/ingest/default.json > /usr/share/filebeat/module/nginx/access/ingest/default.json #Added this line > USER root With this docker image, I checked the running pod and the ingest file does not the geoip references. But it did not work. Thanks ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [December 6, 2019, 4:43pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/4 "2019-12-06T16:43:53Z")
Hmmm did you build filebeat-oss from the source code? Maybe something like [https://github.com/elastic/beats/blob/master/filebeat/tests/open-file-handlers/Dockerfile-filebeat](https://github.com/elastic/beats/blob/master/filebeat/tests/open-file-handlers/Dockerfile-filebeat) ---
**Author:** ![john\_eapen](https://avatars.discourse-cdn.com/v4/letter/j/b3f665/32.png) [@john\_eapen](https://discuss.elastic.co/u/john_eapen)\ **Post date:** [December 12, 2019, 10:38pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/5 "2019-12-12T22:38:04Z")
Hi Kaiyan, Appreciate your help. Sorry could not reply to you earlier. > did you build filebeat-oss from the source code? > Not I did not build the entire filebeat-oss from source code. But as I mentioned earlier, I made sure that the "module/nginx/access/ingest/default.json" that is used by filebeat does not have any references to "geo-ip". I did that by including this modified default.json into my own dockerfile/build. My question is, Is it necessary to rebuilt filebeat-oss ? Is the nginx ingest/default.json not read from the file by filebeat at startup. ? Thanks John ---
**Author:** ![Kaiyan\_Sheng](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kaiyan_sheng/32/38247_2.png) [@Kaiyan\_Sheng](https://discuss.elastic.co/u/Kaiyan_Sheng)\ **Post date:** [December 16, 2019, 5:26pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/6 "2019-12-16T17:26:22Z")
Sorry I just came back from vacation. I think the way you are doing will work. But there are more than nginx module is using geoip and I believe all the modules that uses geoip needs to have a new/updated default.json file. Maybe give that a try? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 13, 2020, 5:32pm UTC](https://discuss.elastic.co/t/filebeat-nginx-module-does-not-work-with-aws-es/210449/7 "2020-01-13T17:32:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.