# Okta filebeat module ingest pipeline not running

**URL:** <https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [August 19, 2021, 7:42am UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917 "2021-08-19T07:42:25Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![LiamSennitt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liamsennitt/32/87475_2.png) [@LiamSennitt](https://discuss.elastic.co/u/LiamSennitt)\
**Post date:** [August 19, 2021, 7:42am UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917/1 "2021-08-19T07:42:25Z")

</div>

The Okta filebeat module doesn't appear to be executing the [ingest pipeline](https://github.com/elastic/beats/blob/master/x-pack/filebeat/module/okta/system/ingest/pipeline.yml) as expected and returns events in the structure below.

```json
{
    "@timestamp": "",
    "@metadata": {
      "beat": "filebeat",
      "type": "_doc",
      "version": "7.14.0",
      "pipeline": "filebeat-7.14.0-okta-system-pipeline"
    },
    "json": {},
    "agent": {
      "type": "filebeat",
      "version": "7.14.0",
      "hostname": "",
      "ephemeral_id": "",
      "id": "",
      "name": ""
    },
    "event": {
      "dataset": "okta.system",
      "original": "",
      "created": "",
      "module": "okta"
    },
    "ecs": {
      "version": "1.10.0"
    },
    "tags": [
      "forwarded"
    ],
    "input": {
      "type": "httpjson"
    },
    "fileset": {
      "name": "system"
    },
    "service": {
      "type": "okta"
    }
}

```

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [August 19, 2021, 11:14am UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917/2 "2021-08-19T11:14:49Z")

</div>

This is an event coming out of filebeat? Or from elasticsearch?

---

<div class="post-metadata">

**Author:** ![LiamSennitt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liamsennitt/32/87475_2.png) [@LiamSennitt](https://discuss.elastic.co/u/LiamSennitt)\
**Post date:** [August 19, 2021, 1:32pm UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917/3 "2021-08-19T13:32:56Z")

</div>

Directly out of filebeat with a console output.

---

<div class="post-metadata">

**Author:** ![LiamSennitt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/liamsennitt/32/87475_2.png) [@LiamSennitt](https://discuss.elastic.co/u/LiamSennitt)\
**Post date:** [August 19, 2021, 1:39pm UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917/4 "2021-08-19T13:39:08Z")

</div>

I've realised my mistake I'm using filebeat with a logstash output and I havn't manually loaded the ingest pipline 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 16, 2021, 3:39pm UTC](https://discuss.elastic.co/t/okta-filebeat-module-ingest-pipeline-not-running/281917/5 "2021-09-16T15:39:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.