# How to use pipelines/processors with autodiscover

**URL:** <https://discuss.elastic.co/t/how-to-use-pipelines-processors-with-autodiscover/156659>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [November 14, 2018, 12:44pm UTC](https://discuss.elastic.co/t/how-to-use-pipelines-processors-with-autodiscover/156659 "2018-11-14T12:44:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Denis\_Baryshev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/denis_baryshev/32/37620_2.png) [@Denis\_Baryshev](https://discuss.elastic.co/u/Denis_Baryshev)\
**Post date:** [November 14, 2018, 12:44pm UTC](https://discuss.elastic.co/t/how-to-use-pipelines-processors-with-autodiscover/156659/1 "2018-11-14T12:44:54Z")

</div>

Hello I have the following config file,

and I'm already pretty lost and I don't know where to direct log-format json logs to my custom "json-message" pipeline or where to use "decode\_json\_fields".

Please help

```auto
filebeat.config:
  inputs:
    path: ${path.config}/prospectors.d/*.yml
    reload.enabled: false
  
  modules:
    path: /modules.d/*.yml
    reload.enabled: false
    
filebeat.autodiscover:
  providers:
  - hints.enabled: false
    templates:
    - condition:
        equals:
          kubernetes.labels.app: mongodb
      config:
      - log:
          input:
            containers.ids:
            - ${data.kubernetes.container.id}
            exclude_lines:
            - ^\s+[\-`('.|_]
            type: docker
        module: mongodb
    - condition:
        equals:
          kubernetes.labels.app: redis
      config:
      - log:
          input:
            containers.ids:
            - ${data.kubernetes.container.id}
            exclude_lines:
            - ^\s+[\-`('.|_]
            type: docker
        module: redis
        slowlog:
          enabled: false
    - condition:
        equals:
          kubernetes.labels.log-format: json
      config:
      - containers.ids:
        - ${data.kubernetes.container.id}
        exclude_lines:
        - ^\s+[\-`('.|_]
        type: docker
    type: kubernetes

filebeat.inputs: []

http.enabled: false
http.port: 5066

output.elasticsearch:
  hosts:
  - logs-elasticsearch-client:9200

output.file:
  filename: filebeat
  number_of_files: 5
  path: /usr/share/filebeat/data
  rotate_every_kb: 10000

output.file.enabled: false

processors:
- add_cloud_metadata: null

setup.kibana:
  host: http://logs-kibana:5601

setup.template:
  enabled: true
  overwrite: false
  settings:
    index.number_of_replicas: 1
    index.number_of_shards: 1

```

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [November 15, 2018, 3:16pm UTC](https://discuss.elastic.co/t/how-to-use-pipelines-processors-with-autodiscover/156659/2 "2018-11-15T15:16:41Z")

</div>

Is there any specific input/module not working correctly for you?

You configured mostly modules. The last one is the only input. Here you can add additional processor configurations or use the pipeline setting to forward processing for this input to Ingest Node. e.g.:

```auto
    - condition:
        equals:
          kubernetes.labels.log-format: json
      config:
      - type: docker
        containers.ids:
          - ${data.kubernetes.container.id}
        exclude_lines:
          - ^\s+[\-`('.|_]
        processors:
          - decode_json_fields:
              fields: ["message"]

```

I just added the json processor to your docker input.

Tip: add `type` or `module` to the beginning of a configuration block. This makes it easier to see what will be actually configured.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 13, 2018, 3:19pm UTC](https://discuss.elastic.co/t/how-to-use-pipelines-processors-with-autodiscover/156659/3 "2018-12-13T15:19:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.