# Logstash problem with disabling ecs\_compatibility

**URL:** <https://discuss.elastic.co/t/logstash-problem-with-disabling-ecs-compatibility/321740>\
**Category:** Logstash\
**Created:** [December 21, 2022, 9:10am UTC](https://discuss.elastic.co/t/logstash-problem-with-disabling-ecs-compatibility/321740 "2022-12-21T09:10:50Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Anonym123](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Anonym123](https://discuss.elastic.co/u/Anonym123)\
**Post date:** [December 21, 2022, 9:10am UTC](https://discuss.elastic.co/t/logstash-problem-with-disabling-ecs-compatibility/321740/1 "2022-12-21T09:10:50Z")

</div>

logstash image is: 7.17.3 with the prune plugin  
This is my logstash.conf

```auto
    pipeline.ecs_compatibility: disabled 
    input {
      beats {
        port => "XXXXXX"
        ecs_compatibility => disabled
      }
    }
    
    filter {
      prune {
        remove_field => ["[agent][version]"]
        ecs_compatibility => disabled
      }
    }

    output { 
      elasticsearch { 
        hosts => "XXXXXXXXXXXX"
        ecs_compatibility => disabled
      } 
    }

```

I get this error with pipeline.ecs\_compatibility: disabled  
I found this setting at [ECS in Logstash | Logstash Reference [7.17] | Elastic](https://www.elastic.co/guide/en/logstash/7.17/ecs-ls.html)

```auto
[2022-12-21T08:56:07,531][ERROR][logstash.agent] Failed to execute action {:action=>LogStash::PipelineAction::Create/pipeline_id:main, :exception=>"LogStash::ConfigurationError", :message=>"Expected one of [\\t\\r\\n], \"#\", \"input\", \"filter\", \"output\" at line 8, column 1 (byte 195) after ", :backtrace=>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:32:in `compile_imperative'", "org/logstash/execution/AbstractPipelineExt.java:189:in `initialize'", "org/logstash/execution/JavaBasePipelineExt.java:72:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:52:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:383:in `block in converge_state'"]}
[2022-12-21T08:56:07,729][INFO][logstash.runner] Logstash shut down.
[2022-12-21T08:56:07,736][FATAL][org.logstash.Logstash] Logstash stopped processing because of an error: (SystemExit) exit

```

And without the pipeline.ecs\_compatibility: disabled Logstash spamming this.

```auto
Relying on default value of `pipeline.ecs_compatibility`, which may change in a future major release of Logstash. To avoid unexpected changes when upgrading Logstash, please explicitly declare your desired ECS Compatibility mode.

```

Is there another way to get rid of this log spamming?

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [December 21, 2022, 11:50am UTC](https://discuss.elastic.co/t/logstash-problem-with-disabling-ecs-compatibility/321740/2 "2022-12-21T11:50:26Z")

</div>

> [@Anonym123](#):
>
> `pipeline.ecs_compatibility: disabled `

This should not be in your pipeline configuration file, it needs to be in `logstash.yml` file or if you are using multiple pipelines, in the `pipelines.yml` file.

In pipeline configurations you can only have `input`, `filter`, and `output` blocks, everything needs to be inside one of those blocks.

---

<div class="post-metadata">

**Author:** ![Anonym123](https://avatars.discourse-cdn.com/v4/letter/a/3d9bf3/32.png) [@Anonym123](https://discuss.elastic.co/u/Anonym123)\
**Post date:** [December 21, 2022, 12:18pm UTC](https://discuss.elastic.co/t/logstash-problem-with-disabling-ecs-compatibility/321740/3 "2022-12-21T12:18:06Z")

</div>

I appreciate your help  
It works. 😄

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 18, 2023, 12:18pm UTC](https://discuss.elastic.co/t/logstash-problem-with-disabling-ecs-compatibility/321740/4 "2023-01-18T12:18:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.