What ingest pipeline will be used?

Elastic Stack Kibana
1

In a Logstash -> Elastic setup, how do we know which ingest pipeline will be used to process the data?

As an example, in this guide we have the following Logstash config. What pipeline will be used in the else condition?

output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "https://myEShost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "https://myEShost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      user => "elastic"
      password => "secret"
    }
  }
}
2

None, the elasticsearch output in the else condition does not have the pipeline option, so it will not run any ingest pipeline in Elasticsearch.

3

Does that mean that Kibana (or any other entity) will never parse that message, so that it's always stored as simple, unparsed text?

4

Yes, since Elasticsearch will not use any ingest pipeline in this case, the message will note be changed after it is received.

1 Like
5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.