Move E.C.S. extractions / ingest pipeline to Logstash Pipeline

We are looking at moving from 6.4.2 to 7.x amongst the changes would be moving from our current data model to the Elastic Common Schema (ECS).

I understand that the Elastic Ingest Nodes have these extractions 'built-in', but how can I move these regex's and extractions etc etc to a Log Stash Pipeline.

Is there a way for me to dump the ingest pipeline - so that I can move it to a logstash pipeline?


For anyone else reading.
On a (Linux) host with Filebeats 7.4 there is the ECS extractions at: /usr/share/filebeat/module/apache/access/ingest/default.json

As an example. Hopefully you can figure the rest out.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Indeed. If you'd like to look at them right in the Beats repo, you can check out the comment here for pointers: Logstash to ECS