Logstash 8.11 Geoip filter plugin does not enhancing the apache access data

The main issue is that the logstash.yml already have pipeline.ecs_compatibility: disabled, but it still not working, so something is not right.

Let's go back a little, are you running Logstash always using the command line or are you also running it as a service?

Your logstash.yml is pretty normal and has nothing wrong, with pipeline.ecs_compatibility: disabled you shouldn't get any error like the one you shared.

Can you do the following:

  • Stop Logstash.
  • Run logstash with the following command line:
/usr/share/logstash/bin/logstash --path.settings /etc/logstash -f /etc/logstash/conf.d/apache.conf
  • Share all the logs generated.