# Logstash is not creating ingest pipelines

**URL:** https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953
**Category:** Logstash
**Created:** [June 15, 2021, 7:11am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953 "2021-06-15T07:11:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Mocem](https://avatars.discourse-cdn.com/v4/letter/m/958977/32.png) [@Mocem](https://discuss.elastic.co/u/Mocem)
#### Post date: [June 15, 2021, 7:11am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953/1 "2021-06-15T07:11:51Z")

</div>

Hi All,

For the past few days I'm struggling with loading the pipelines from filebeat. Basically nothing is happening. It works directly to Elastic but not when logstash is in between. Once I create the ingest pipeline manually it starts to log without a problem.

The weird thing is I now have 2 test setups one with SSL and one without. Both behave the same. For an unknown reason there is very little logging and the documentation is pretty clear how to load pipelines. The must be something I'm missing I was hoping someone could point me in the right direction.

Logstash keeps logging the following messages.

```auto
"status"=>400, "error"=>{"type"=>"illegal_argument_exception", "reason"=>"pipeline with id [filebeat-7.12.1-system-auth-pipeline] does not exist"}}}}

```

logstash config

```auto
input {
  beats {
    port => 5400
    host => "0.0.0.0"
  }
}

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => ["http://10.0.15.80:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}"
    }
  } else {
    elasticsearch {
      hosts => ["http://10.0.15.80:9200"]
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
    }
  }
}

```

Thanks in advance

Marco

---

<div class="post-metadata">

### Author: ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [June 15, 2021, 7:26am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953/2 "2021-06-15T07:26:50Z")

</div>

Pipelines need to be loaded directly into Elasticsearch from the Beat, not via Logstash. See [Load ingest pipelines | Filebeat Reference [8.11] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/load-ingest-pipelines.html);

> If you’re sending events to Logstash, or plan to use [Beats central management](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-central-management.html), you need to load the ingest pipelines manually.

---

<div class="post-metadata">

### Author: ![Mocem](https://avatars.discourse-cdn.com/v4/letter/m/958977/32.png) [@Mocem](https://discuss.elastic.co/u/Mocem)
#### Post date: [June 15, 2021, 9:35am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953/3 "2021-06-15T09:35:42Z")

</div>

Thank you for the quick reply.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2021, 9:36am UTC](https://discuss.elastic.co/t/logstash-is-not-creating-ingest-pipelines/275953/4 "2021-07-13T09:36:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.