Regarding Ingest Pipeline Upload

Hi,
I'm not seeing expected behaviour when uploading logstash ingest pipelines:

$ filebeat setup --pipelines --modules logstash
Loaded Ingest pipelines

However, when I look at the pipelines in elasticsearch I see that plain text pipelines have been uploaded as opposed to json...

How do I get filebeat to setup the json pipelines?

Regards,
D

Hi,

This is happening because the default format for the logstash module's ingest pipelines is plaintext, not json. I have a couple of questions that might help me determine the easiest way forward to help you load the json pipelines:

  1. Is your logstash module enabled? You can check by running filebeat modules list.

  2. If the answer to (1) is yes, then what does your modules.d/logstash.yml file look like?

Thanks,

Shaunak

I see. The default format for the pipeline upload was set to plain-text. Can this be overridden in the main config?

Hi, I just figured this out. You can run the following command:

$ filebeat setup --pipelines --modules logstash -M 'logstash.*.var.format=json'

These will load the json pipelines instead of the plaintext ones for all filesets in the logstash module.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.