Andrew-
Thanks for the pointer. That got it!
curl -XGET 'http://localhost:9200/_ingest/pipeline'
(shows all of the pipelines in place)
curl -XDELETE 'http://localhost:9200/_ingest/pipeline/filebeat-6.3.1-system-auth-pipeline'
curl -XDELETE 'http://localhost:9200/_ingest/pipeline/filebeat-6.3.1-system-syslog-pipeline'
( I probably didn't need to remove both of the pipelines, but just to be sure)
curl -XGET 'http://localhost:9200/_ingest/pipeline'
( showed a much shorter list)
I'm a little surprised that filebeat doesn't (or can't) update an existing pipeline when parameters are updated in the Filebeat config. Is there a reason for that?
--
Ray Frush
Colorado State University