Right way to make ingest pipeline work

Elastic Stack Beats
1
  • create a ingest pipeline in kibana
    • test with kibana.dev-tool.grok .... ok
    • test with kibana.ingest.test-pipeline ... ok
    • test with POST index/?pipeline=xxx ... ok
  • call by filebeat.yml
    • filebeat.yml
output.elasticsearch:
  hosts: ["es:9200"]
  pipeline: "pp123"

filebeat.inputs:
- type: log
  index: "test7-%{+yyyy.MM.dd}"
  paths:
  - '/test-log/test7*.log'
  fields:
    ktype: ka
  fields_under_root: true

but this not work, pipeline never called.

with the discuss from: ingest-pipeline-not-working-for-filebeat
i set index settings with final_pipeline, ingest works.

so the question:

  • it this the right way?
  • if we have to handy set index.settings for final_pipeline, what's the meaning of filebeat.yml pipeline used for?
  • why official docs never tell this.
  • what's the differents between ingest.pipeline, processors.module.
  • why processors.grok not exists?

elk,beats version=7.9

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.