Using a custom ingest pipeline with a module

Elastic Stack Elasticsearch
1

Picking back up on a topic that I shelved a while back: Apache HTTPD logs with (comma-delimited) X-Forwarded-For IPs

@jsoriano had been helping me and suggested that I try the following to invoke a custom ingest pipeline:

filebeat.modules:
  - module: apache
    access:
      input:
        pipeline: apache_with_x_forwarded_for
        paths: ["/var/log/apache2/access*"]
    error:
      var.paths: ["/var/log/apache2/error*"]

Unfortunately, that doesn't seem to have any effect on the pipeline used, since it still seems to be using the stock one (none of my changes are reflected in the indexed data).

Any suggestions as to the best path forward?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.