# Ingest pipeline differences with Logstash and Beats
**URL:** https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302
**Category:** Logstash
**Created:** [March 4, 2021, 11:46pm UTC](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302 "2021-03-04T23:46:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@b133](https://discuss.elastic.co/u/b133)
#### Post date: [March 4, 2021, 11:46pm UTC](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302/1 "2021-03-04T23:46:49Z")
I want to bifurcate my logs using Logstash. When I sent logs directly from Filebeat to Elasticsearch, the log fields were all properly parsed and converted to appropriate variable types.
I have since changed the Filebeat output to Logstash and configured Logstash to send logs to Elasticsearch. I have also made sure to load the ingest pipelines manually:
`filebeat setup --pipelines --modules panw,checkpoint`
Even after loading the ingest pipelines, the log fields are not being fully parsed in Elasticsearch. For my `panw` module logs, some fields are parsed but most of the type conversion is lost. For `checkpoint` module logs, it fails to parse and identify most fields, leaving them lumped in the `message` field.
My temporary workaround is just to mirror the incoming traffic to another virtual host and run logstash over there. But that's a pretty ugly workaround until I can figure out how to get Filebeat and Logstash to cooperate. I'm guessing I just missed a step, but I'm not sure how to continue troubleshooting at this point. Any advice?
Here's a relevant bit of my Logstash configuration:
```auto
input {
beats {
host => "127.0.0.1"
port => "5044"
}
}
output {
if "pan-os" in [tags] {
elasticsearch {
ilm_policy => "my-policy-01"
ilm_rollover_alias => "panw"
ilm_pattern => "{now/d}-01"
hosts => ["localhost:9200"]
user => "${es_user}"
password => "${es_pwd}"
}
}
...
```
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [March 4, 2021, 11:51pm UTC](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302/2 "2021-03-04T23:51:34Z")
I think you need to be setting the [pipeline](https://www.elastic.co/guide/en/logstash/master/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-pipeline) option on the elasticsearch output so that the output will tell elasticsearch which ingest pipeline to run.
---
### Author:  [@b133](https://discuss.elastic.co/u/b133)
#### Post date: [March 5, 2021, 5:11pm UTC](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302/3 "2021-03-05T17:11:27Z")
Thanks for your quick response! I'm now seeing parsed fields after setting the Beats pipeline within my Logstash `output{elasticsearch{}}` stanza:
```auto
pipeline => "%{[@metadata][pipeline]}"
manage_template => false
```
Cheers
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 2, 2021, 5:12pm UTC](https://discuss.elastic.co/t/ingest-pipeline-differences-with-logstash-and-beats/266302/4 "2021-04-02T17:12:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.