The Grok patttern defined in the mysql slowlog ingest pipeline uses the WORD grok pattern to extract schema.
This causes the pipeline to fail if schema contains a dash.
Using the same pattern as USERNAME seems to fix the issue.
My problem is that the module uses the "filebeat--mysql-slowlog-pipeline" which is changed eveytime I upgrade filebeat.
How can I make this change permanent?