I have setup filebeat with basic config as a proof of concept. After starting the service, i couldnt see any logs ingested by ES, but filebeat error log shows:
2019-11-26T15:56:28.174Z ERROR pipeline/output.go:100 Failed to connect to backoff(elasticsearch(http://xxx.eu-west-1.es.amazonaws.com:80)): Connection marked as failed because the onConnect callback failed: Error loading pipeline for fileset iis/error: This module requires the following Elasticsearch plugins: ingest-geoip. You can install them by running the following commands on all the Elasticsearch nodes:
sudo bin/elasticsearch-plugin install ingest-geoip.
From AWS ES specs, the ingest-geoip plugin is not supported. Is it possible to have filebeat running but with ingest-geoip disabled.
could be an optional feature, rather than a requirement.