# How to find the ingest pipeline used to parse for Nginx logs

**URL:** https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263
**Category:** Kibana
**Tags:** ingest-pipeline
**Created:** [August 3, 2022, 7:03am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263 "2022-08-03T07:03:45Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Maduranga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maduranga/32/109172_2.png) [@Maduranga](https://discuss.elastic.co/u/Maduranga)
#### Post date: [August 3, 2022, 7:03am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263/1 "2022-08-03T07:03:45Z")

</div>

Hi,

I am using Elastic cloud to send our Nginx logs using Filebeat Nginx module.  
However, the Nginx log is not parsed and gives "`Provided Grok expressions do not match field value`" error.

The `event.original` field that contains the log is of JSON format. And I want to change the processor from Grok to JSON in the ingest pipeline.

However, I cannot figure out which ingest pipeline is used in Kibana to parse my Nginx logs.  
How can I find out which pipeline is used and to change the pipeline? Is this something I can do in Kibana, or do I need change the configuration file?

This is my nginx.yml config:

```auto
- module: nginx
  access:
    enabled: true
    input:
      pipeline: filebeat-8.2.0-nginx-access-pipeline-custom
    var.paths: ["/shared/log/access_nginx.log"]
  error:
    enabled: true
    var.paths: ["/shared/log/error_nginx.log"]

```

Thank you.

---

<div class="post-metadata">

### Author: ![79g](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/79g/32/109191_2.png) [@79g](https://discuss.elastic.co/u/79g)
#### Post date: [August 3, 2022, 11:00am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263/2 "2022-08-03T11:00:26Z")

</div>

Hello,

you can see all the pipelines in Kibana --\> management page. Which Kibana version are you using? It depends a little of the version.

For example, in v8.3.2:

 ![pipelines](https://us1.discourse-cdn.com/elastic/original/3X/8/6/86cbaa38e881b3b6673bedb33bfb0143058c9e8a.png)

 ![pipelines2](https://us1.discourse-cdn.com/elastic/original/3X/6/9/693f23247833f8c68721cafe178bbc9d0aad8141.png)

If you click the pipeline you'll see the patterns.

Hope it helps.

---

<div class="post-metadata">

### Author: ![Maduranga](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/maduranga/32/109172_2.png) [@Maduranga](https://discuss.elastic.co/u/Maduranga)
#### Post date: [August 4, 2022, 1:22am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263/3 "2022-08-04T01:22:44Z")

</div>

Thanks a lot Daniel.  
Yeap, found them.

---

<div class="post-metadata">

### Author: ![79g](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/79g/32/109191_2.png) [@79g](https://discuss.elastic.co/u/79g)
#### Post date: [August 4, 2022, 8:26am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263/4 "2022-08-04T08:26:43Z")

</div>

Nice!

If you mark my previous response as `solution` it will help other users also.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2022, 8:26am UTC](https://discuss.elastic.co/t/how-to-find-the-ingest-pipeline-used-to-parse-for-nginx-logs/311263/5 "2022-09-01T08:26:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.