Filebeat not sending through ingest pipeline - CURL does

Elastic Stack Beats
1

I have created a Ingest pipeline for my logs.

Filebeat is sending the logs to Elasticsearch, but they are not going through the Ingest Pipeline, and I am just getting the raw message rather than the structured fields.

When I PUT filebeat-2016.11.17/log/123ID?pipeline=spring-log from a REST client or CURL it works just fine.

My filebeat.yml on output follows the documentation.

output:

  ### Elasticsearch as output
  elasticsearch:
    # Array of hosts to connect to.
    hosts: ["localhost:9200"]
    pipeline: "spring-log"

Debug mode shows that logs are being successfully sent, and what is being sent, but does not show the URL and whether it is including the pipeline parameter.

I have also tried using parameter.pipeline - but that does not appear to work either.

Using Elastic 5 and Filebeat 5.

2

Can you double check your Filebeat version with filebeat -version?

I just tested the pipeline config with FB 5.0.1 and it works using:

output.elasticsearch:
  hosts: ['localhost:9200']
  pipeline: test

BTW It's parameters not parameter.

3

That was the problem Still had the old version of filebeat installed. Upgrading did the trick.
Thank you.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.