Filebeat send to ES ingest pipeline but can't create index

I would like to send log to to ingest node pipeline this is my config
before I send the log via filebeat I was created pipeline on ES and see filebeat log send the log to ES.
I have question

  • Why I can't see index name "abc" on ES
  • Is this true on output.elasticsearch should be set to ingest node only ? I have 3 master,data node and 2 ingest node

filebeat version 7.3.2 (amd64), libbeat 7.3.2
Elastisearch version 7.3

- type: log
  enabled: true
  tail_files: true
  - /tmp/service.log
  pipeline: "testpipeline"
setup.template.enabled: false
#================================ Outputs =====================================
  hosts: ["",""]
  index: abc

filebeat.registry.path: /var/lib/filebeat/registry/test

Elasticsearch pipline

PUT _ingest/pipeline/testpipeline
        "description": "Pipeline for test",
        "processors": [{
                "grok": {
                    "ignore_missing": true,
                    "field": "message",

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.