# Ingest pipeline is not being used in the events sent by filebeat

**URL:** https://discuss.elastic.co/t/ingest-pipeline-is-not-being-used-in-the-events-sent-by-filebeat/120596
**Category:** Elasticsearch
**Created:** [February 20, 2018, 9:56am UTC](https://discuss.elastic.co/t/ingest-pipeline-is-not-being-used-in-the-events-sent-by-filebeat/120596 "2018-02-20T09:56:49Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jeraldsm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jeraldsm/32/11005_2.png) [@jeraldsm](https://discuss.elastic.co/u/jeraldsm)
#### Post date: [February 20, 2018, 9:56am UTC](https://discuss.elastic.co/t/ingest-pipeline-is-not-being-used-in-the-events-sent-by-filebeat/120596/1 "2018-02-20T09:56:49Z")

</div>

I have an issue where Ingest pipeline is not being used in the events sent by filebeat.

I have created an ingest pipeline with simple grok patterns using put ingest API.  
and I use filebeat to sent events to elasticsearch.

Pipeline view from the kibana dev tools is shown below:

> GET \_ingest/pipeline/console\_log
> 
> {  
> "console\_log": {  
> "description": "Ingest pipeline for Console Log Format",  
> "processors": [  
> {  
> "grok": {  
> "field": "message",  
> "patterns": [  
> "%{TIMESTAMP\_ISO8601:jvm\_timestamp} [?%{LOGLEVEL:level}]? %{GREEDYDATA:detail}"  
> ]  
> }  
> },  
> {  
> "date": {  
> "timezone": "Europe/Berlin",  
> "field": "jvm\_timestamp",  
> "formats": [  
> "ISO8601"  
> ]  
> }  
> }  
> ]  
> }  
> }

My file beat configuration is the following:

> #=========================== Filebeat prospectors =============================
> 
> filebeat.prospectors:
> 
> - input\_type: log  
> paths:
> 
> - input\_type: log  
> paths:
> 
> #-------------------------- Elasticsearch output ------------------------------  
> output.elasticsearch:  
> hosts: ["192.168.0.1:9200"]  
> pipelines:  
> - pipeline: console\_log  
> when.equals:  
> fields.application: "Tomcat"  
> - pipeline: console\_log  
> when.equals:  
> fields.application: "Solr"

My logs starts in the following format "`2018-02-20T10:48:30.085+0100 INFO....`."

I am supposed to see the new fields like **jvm\_timestamp** and **level** in kibana, but I cannot find them.  
Any help would be appreciated.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 20, 2018, 9:57am UTC](https://discuss.elastic.co/t/ingest-pipeline-is-not-being-used-in-the-events-sent-by-filebeat/120596/2 "2018-03-20T09:57:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.