Regarding Ingest Pipeline Upload

Elastic Stack Beats
1

Hi,
I'm not seeing expected behaviour when uploading logstash ingest pipelines:

$ filebeat setup --pipelines --modules logstash
Loaded Ingest pipelines

However, when I look at the pipelines in elasticsearch I see that plain text pipelines have been uploaded as opposed to json...

How do I get filebeat to setup the json pipelines?

Regards,
D

2

Hi,

This is happening because the default format for the logstash module's ingest pipelines is plaintext, not json. I have a couple of questions that might help me determine the easiest way forward to help you load the json pipelines:

  1. Is your logstash module enabled? You can check by running filebeat modules list.

  2. If the answer to (1) is yes, then what does your modules.d/logstash.yml file look like?

Thanks,

Shaunak

3

I see. The default format for the pipeline upload was set to plain-text. Can this be overridden in the main config?

4

Hi, I just figured this out. You can run the following command:

$ filebeat setup --pipelines --modules logstash -M 'logstash.*.var.format=json'

These will load the json pipelines instead of the plaintext ones for all filesets in the logstash module.