Like I said I haven't built this myself. I suggest you look at:
- the raw packets coming into filebeat (tcpdump is good for this)
- the HTTP requests being written into elasticsearch (tcpdump is also helpful here, unless you've enabled SSL encryption). Check they invoke the pipeline.
- the documents after they are stored in elasticsearch
- the functioning of the ingest pipeline - see https://www.elastic.co/guide/en/elasticsearch/reference/master/simulate-pipeline-api.html
Then you can work out where the problem is.