# How to reference filebeat module fields in logstash filter?

**URL:** <https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001>\
**Category:** Logstash\
**Created:** [July 21, 2020, 10:22am UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001 "2020-07-21T10:22:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [July 21, 2020, 10:22am UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/1 "2020-07-21T10:22:55Z")

</div>

We have filebeat apache module enabled which sends to data to logstash for further enrichment (geoip, add more fields for our visualizations etc).

I tried this one

> **[Use ingest pipelines for parsing | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/use-ingest-pipelines.html)**

but im not sure if its possible.

this is what we're trying to do..

> input {  
> //beats  
> }  
> filter {  
> //We need to access the module fields including the complete ECS fields to enrich geographic locations of our customer  
> }  
> output {  
> //es with pipeline defined  
> }

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [July 21, 2020, 12:44pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/2 "2020-07-21T12:44:46Z")

</div>

Hi  
ingest pipeline is a definition of a series of processes which is installed into Elasticsearch ingest node. Logstash is configured to use ingest pipeline that installed in Elasticsearch.  
This is the definition of ingest pipeline.  
[https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [July 24, 2020, 12:44pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/3 "2020-07-24T12:44:02Z")

</div>

Thank you wang,

but is there a way on how we can transform the data after the pipeline processed in the ingest node?

---

<div class="post-metadata">

**Author:** ![bwwlistens](https://avatars.discourse-cdn.com/v4/letter/b/cab0a1/32.png) [@bwwlistens](https://discuss.elastic.co/u/bwwlistens)\
**Post date:** [July 24, 2020, 2:30pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/4 "2020-07-24T14:30:19Z")

</div>

For a description of each field in the module, see the exported fields section[!](https://www.logiguard.com/bwwlistens/)

---

<div class="post-metadata">

**Author:** ![wangqinghuan](https://avatars.discourse-cdn.com/v4/letter/w/d26b3c/32.png) [@wangqinghuan](https://discuss.elastic.co/u/wangqinghuan)\
**Post date:** [July 27, 2020, 2:05am UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/5 "2020-07-27T02:05:26Z")

</div>

You can transform the data in the pipeline processes rather than Logstash filter.

---

<div class="post-metadata">

**Author:** ![inhinyera16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inhinyera16/32/61625_2.png) [@inhinyera16](https://discuss.elastic.co/u/inhinyera16)\
**Post date:** [August 3, 2020, 1:18pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/6 "2020-08-03T13:18:53Z")

</div>

thank you wang. I dont think i can do that right? (calling the fields in logstash after ingest pipeline transformation)? i've been searching so long and till now i dont find any solution.

Anyways the team decided to use the logstash for transformation instead of ingest pipeline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 31, 2020, 1:19pm UTC](https://discuss.elastic.co/t/how-to-reference-filebeat-module-fields-in-logstash-filter/242001/7 "2020-08-31T13:19:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.