# Pipeline definition in filebeat.yml doesn't work
**URL:** https://discuss.elastic.co/t/pipeline-definition-in-filebeat-yml-doesnt-work/229009
**Category:** Beats
**Tags:** filebeat
**Created:** [April 21, 2020, 9:47am UTC](https://discuss.elastic.co/t/pipeline-definition-in-filebeat-yml-doesnt-work/229009 "2020-04-21T09:47:18Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Burga](https://discuss.elastic.co/u/Burga)
#### Post date: [April 21, 2020, 9:47am UTC](https://discuss.elastic.co/t/pipeline-definition-in-filebeat-yml-doesnt-work/229009/1 "2020-04-21T09:47:18Z")
Hi ,
trying to configure filebeat to use pipeline , but it doesnt work
my filebeat.yml pipeline configuration looks like this
```auto
filebeat.inputs:
- type: log
paths:
- /var/log/messages
# - /var/log/*.log
document_type: syslog
fields:
log_type: "syslog"
enable: true
fields_under_root: true
pipeline: "filebeat-7.6.1-system-auth-pipeline"
multiline.pattern: '^[0-9][0-9]:[0-9][0-9]:'
multiline.negate: true
multiline.match: after
- type: log
paths:
- /var/log/secure
# - /var/log/*.log
document_type: syslog
fields:
log_type: "secure"
enable: true
pipeline: "filebeat-7.6.1-system-auth-pipeline"
fields_under_root: true
multiline.pattern: '^[0-9][0-9]:[0-9][0-9]:'
multiline.negate: true
multiline.match: after
```
filebeat is up and working but it doesn't use pipeline
need your assistance.
Thanks in advance.
---
### Author:  [@shaunak](https://discuss.elastic.co/u/shaunak)
#### Post date: [April 21, 2020, 10:02am UTC](https://discuss.elastic.co/t/pipeline-definition-in-filebeat-yml-doesnt-work/229009/2 "2020-04-21T10:02:34Z")
Please always post your **complete** `filebeat.yml` configuration (with sensitive information redacted), otherwise we can't tell if some other configuration setting is interfering and we also can't easily try to reproduce your issue.
Shaunak
---
### Author:  [@Burga](https://discuss.elastic.co/u/Burga)
#### Post date: [April 21, 2020, 10:12am UTC](https://discuss.elastic.co/t/pipeline-definition-in-filebeat-yml-doesnt-work/229009/3 "2020-04-21T10:12:26Z")
sorry
```auto
filebeat.modules:
filebeat.inputs:
- type: log
paths:
- /var/log/messages
# - /var/log/*.log
document_type: syslog
fields:
log_type: "syslog"
enable: true
fields_under_root: true
**pipeline: "filebeat-7.6.1-system-auth-pipeline"**
multiline.pattern: '^[0-9][0-9]:[0-9][0-9]:'
multiline.negate: true
multiline.match: after
- type: log
paths:
- /var/log/secure
# - /var/log/*.log
document_type: syslog
fields:
log_type: "secure"
enable: true
**pipeline: "filebeat-7.6.1-system-auth-pipeline"**
fields_under_root: true
multiline.pattern: '^[0-9][0-9]:[0-9][0-9]:'
multiline.negate: true
multiline.match: after
- type: log
paths:
- /var/log/yum.log
document_type: syslog
fields:
log_type: "yum"
enable: true
pipeline: "filebeat-7.6.1-system-auth-pipeline"
fields_under_root: true
multiline.pattern: '^[0-9][0-9]:[0-9][0-9]:'
multiline.negate: true
multiline.match: after
#----------------------------- Logstash output --------------------------------
output.logstash:
enabled: true
# The Logstash hosts
#hosts: ["localhost:5044"]
hosts: ["il-infra-logs2:5044","il-infra-logs1:5044"]
loadbalance: true
#logging.level: debug
#logging.to_files: true
#logging.files:
#path: /var/log/filebeat
# The name of the files where the logs are written to.
#name: filebeat
name: filebeat
# Optional SSL. By default is off.
# List of root certificates for HTTPS server verifications
#ssl.certificate_authorities: ["/etc/pki/root/ca.pem"]
# Certificate for SSL client authentication
#ssl.certificate: "/etc/pki/client/cert.pem"
# Client Certificate Key
#ssl.key: "/etc/pki/client/cert.key"
#============================= Filebeat modules ===============================
filebeat.config.modules:
# Glob pattern for configuration loading
path: ${path.config}/modules.d/*.yml
# Set to true to enable config reloading
reload.enabled: false
# Period on which files under path should be checked for changes
#reload.period: 10s
#================================ Processors =====================================
# Configure processors to enhance or manipulate events generated by the beat.
processors:
- add_host_metadata: ~
- add_cloud_metadata: ~
- add_docker_metadata: ~
- add_kubernetes_metadata: ~
#================================ Logging =====================================
# Sets log level. The default log level is info.
# Available log levels are: error, warning, info, debug
#logging.level: debug
# At debug level, you can selectively enable logging only for some components.
# To enable all selectors use ["*"]. Examples of other selectors are "beat",
# "publish", "service".
#logging.selectors: ["*"]
logging.level: info
logging.to_files: true
logging.to_syslog: false
logging.json: true
logging.files:
path: '/var/log/filebeat'
name: 'filebeat'
keepfiles: '3'
permissions: '0644'
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 19, 2020, 10:12am UTC](https://discuss.elastic.co/t/pipeline-definition-in-filebeat-yml-doesnt-work/229009/4 "2020-05-19T10:12:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.