# What ingest pipeline will be used?

**URL:** https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535
**Category:** Kibana
**Created:** [February 5, 2024, 12:44pm UTC](https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535 "2024-02-05T12:44:39Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![andy\_j](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@andy\_j](https://discuss.elastic.co/u/andy_j)
#### Post date: [February 5, 2024, 12:44pm UTC](https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535/1 "2024-02-05T12:44:40Z")

</div>

In a Logstash -\> Elastic setup, how do we know which ingest pipeline will be used to process the data?

As an example, in [this guide](https://www.elastic.co/guide/en/logstash/current/use-filebeat-modules-kafka.html) we have the following Logstash config. What pipeline will be used in the else condition?

```auto
output {
  if [@metadata][pipeline] {
    elasticsearch {
      hosts => "https://myEShost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      pipeline => "%{[@metadata][pipeline]}" 
      user => "elastic"
      password => "secret"
    }
  } else {
    elasticsearch {
      hosts => "https://myEShost:9200"
      manage_template => false
      index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
      user => "elastic"
      password => "secret"
    }
  }
}

```

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 5, 2024, 12:59pm UTC](https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535/2 "2024-02-05T12:59:20Z")

</div>

> [@andy\_j](#):
>
> What pipeline will be used in the else condition?

None, the `elasticsearch` output in the _else_ condition does not have the `pipeline` option, so it will not run any ingest pipeline in Elasticsearch.

---

<div class="post-metadata">

### Author: ![andy\_j](https://avatars.discourse-cdn.com/v4/letter/a/7c8e57/32.png) [@andy\_j](https://discuss.elastic.co/u/andy_j)
#### Post date: [February 7, 2024, 9:58am UTC](https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535/3 "2024-02-07T09:58:40Z")

</div>

Does that mean that Kibana (or any other entity) will never parse that message, so that it's always stored as simple, unparsed text?

---

<div class="post-metadata">

### Author: ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [February 7, 2024, 11:35am UTC](https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535/4 "2024-02-07T11:35:06Z")

</div>

> [@andy\_j](#):
>
> Does that mean that Kibana (or any other entity) will never parse that message, so that it's always stored as simple, unparsed text?

Yes, since Elasticsearch will not use any ingest pipeline in this case, the message will note be changed after it is received.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 6, 2024, 11:35am UTC](https://discuss.elastic.co/t/what-ingest-pipeline-will-be-used/352535/5 "2024-03-06T11:35:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
