Ingest Pipeline ID not working for UDP Integration

Elastic Stack Beats
1

Hello,

We are using the Custom UDP integration in Fleet to ingest logs from Untangle firewalls.

I've created an ingest pipeline, called Untangle, that should parse the message field sent over from the integration.

When I test the pipeline in the UI it works as intended.

Also, if i run POST logs-udp.untangle-default/_update_by_query?pipeline=Untangle, it also works correctly.

The issue is if i add the pipeline id to the integration, it does not work. Are there any known issues around adding pipeline id to the custom UDP Integration?

image

Thanks

2

Its because the beats code lowercases the pipeline name and Elasticsearch is case sensitive. See https://github.com/elastic/beats/issues/26570.

1 Like
3

Wow, I spent way too much time on this. Works with lowercase, thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.