Is it possible to enrich windows integration logs ?!

[A_Abdellah (Abdellah Aissat)]

Hi, I'm using windows integration to collect windows event logs, the integration settings offer a field to specify processor, but when try to use enrich processor I stop receiving new logs and i got the following error

I guess the enrich processor is not allowed as it a server-side processor depending on the enrich policy.

Is there any alternatives like having the possibility to specify a pipeline.

[legoguy1000 (Alex)]

Currently the processor field is for local beat processors. If u want to do anything with Elasticsearch pipelines, you'd have to modify the ones that come with each integration.

[leandrojmp (Leandro Pereira)]

It is also possible to just set an index.final_pipeline in the index template to call a pipeline after the pipeline used in the integration.

This way there is no need to modify the integration pipeline, just the index template.

[legoguy1000 (Alex)]

You have to be careful with that as every index template created by fleet managed integrations has a final pipeline already set to do certain fleet things.

[leandrojmp (Leandro Pereira)]

Oh thanks, didn't know, I thought it was just like the beats modules, I'm not using Elastic Agent and have no plan to use it in the near future.

So, in this case the solution would be really to add a new processor in the integration pipeline then.

[A_Abdellah (Abdellah Aissat)]

Thank you very much, I will try it

[donasmello (Darryl)]

Would it be sensible to add your processors to the pipeline .fleet_final_pipeline-1 ? That one appears to be used in all of the integrations via the template .fleet_component_template-1. I tested with an enrich processor on the pipeline and worked so far. Can't see yet why this would be a bad idea.