Okta filebeat module ingest pipeline not running

Elastic Stack Beats
1

The Okta filebeat module doesn't appear to be executing the ingest pipeline as expected and returns events in the structure below.

{
    "@timestamp": "",
    "@metadata": {
      "beat": "filebeat",
      "type": "_doc",
      "version": "7.14.0",
      "pipeline": "filebeat-7.14.0-okta-system-pipeline"
    },
    "json": {},
    "agent": {
      "type": "filebeat",
      "version": "7.14.0",
      "hostname": "",
      "ephemeral_id": "",
      "id": "",
      "name": ""
    },
    "event": {
      "dataset": "okta.system",
      "original": "",
      "created": "",
      "module": "okta"
    },
    "ecs": {
      "version": "1.10.0"
    },
    "tags": [
      "forwarded"
    ],
    "input": {
      "type": "httpjson"
    },
    "fileset": {
      "name": "system"
    },
    "service": {
      "type": "okta"
    }
}
2

This is an event coming out of filebeat? Or from elasticsearch?

3

Directly out of filebeat with a console output.

4

I've realised my mistake I'm using filebeat with a logstash output and I havn't manually loaded the ingest pipline :+1:

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.