Hi @Midnigh7
I am not saying this is the issue but perhaps take at this similar issue. In short if your field name is source.ip on ingest and valid json is not created the rest of the ingest pipelines won't work. That is what the dot expander is for.