# Problems getting pipeline to run in filebeat module

**URL:** <https://discuss.elastic.co/t/problems-getting-pipeline-to-run-in-filebeat-module/171156>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 6, 2019, 4:59pm UTC](https://discuss.elastic.co/t/problems-getting-pipeline-to-run-in-filebeat-module/171156 "2019-03-06T16:59:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![John\_Swift](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_swift/32/41630_2.png) [@John\_Swift](https://discuss.elastic.co/u/John_Swift)\
**Post date:** [March 6, 2019, 4:59pm UTC](https://discuss.elastic.co/t/problems-getting-pipeline-to-run-in-filebeat-module/171156/1 "2019-03-06T16:59:18Z")

</div>

hi folks  
I'm having some trouble with GROK within a custom filebeat module  
Runing filebeat 6.5 on windows

The mudule is ingesting & sending the logs to elasticserach without any issues  
so i dont know if the module is calling the ingest pipeline correctly, debug on filebeat didnt show any obvious problems.

I've listed the contenst of my manifest.yml & the pipeline.json files.  
i'm setting a new field in pipeline.json ifthe processor completes or fails but when i look at the record in elasticsearch the grok\_status feild is missing & no groking has taken place

manifest.yml  
module\_version: 1.0

```
var:
  - name: paths
default:
  - //non-prod-smb-ext.onxinas1a.bskyb.com/N09-KanaResponse/KanaShare_DEV/logs/*.xml

ingest_pipeline: ingest/pipeline.json
input: config/log.yml

```

pipeline.json

```
{
    "description": "Pipeline for parsing Kana application logs",
    "processors": [
        {
            "grok": {
                "field": "message",
                "patterns": [
                    "%{INT:kananode} %{DATA:parition} %{INT:kanaint}"
					],
				"ignore_missing": true
            },
			"set": {
                "field": "grok_status",
                "value": "GROK PARSE OK"
            }
  }
    ],
    "on_failure": [
        {
            "set": {
                "field": "grok_status",
                "value": "GROK PARSE ERROR"
            }
        }
    ]
}
```

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [March 7, 2019, 3:28pm UTC](https://discuss.elastic.co/t/problems-getting-pipeline-to-run-in-filebeat-module/171156/2 "2019-03-07T15:28:01Z")

</div>

@John_Swift Can you check if your pipeline is installed on Elasticsearch?

---

<div class="post-metadata">

**Author:** ![John\_Swift](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/john_swift/32/41630_2.png) [@John\_Swift](https://discuss.elastic.co/u/John_Swift)\
**Post date:** [March 7, 2019, 4:07pm UTC](https://discuss.elastic.co/t/problems-getting-pipeline-to-run-in-filebeat-module/171156/3 "2019-03-07T16:07:07Z")

</div>

& just like that it all clicks into place.....  
Thanks Pier, thats exsaclty what i was missing !!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 4, 2019, 4:07pm UTC](https://discuss.elastic.co/t/problems-getting-pipeline-to-run-in-filebeat-module/171156/4 "2019-04-04T16:07:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.