When applying ingest pipeline it fails with "Parse execption, request body is required"

[syost (Shane Yost)]

I have filebeats going and I'm trying to play around with ingest pipelines. I have accessed the console and defined the following pipeline...

PUT _ingest/pipeline/upper
{
  "description": "Testing lower to uppercase on fileset.name",
  "processors": [
    {
      "uppercase": {
        "field": "fileset.name"
      }
    }
  ]
}

After doing this I validated it was added with GET _ingest/pipeline/upper which returned...

{
  "upper" : {
    "description" : "Testing lower to uppercase on fileset.name",
    "processors" : [
      {
        "uppercase" : {
          "field" : "fileset.name"
        }
      }
    ]
  }
}

I try and test it with a single document via...
PUT filebeat-7.6.2-2020.05.02-000001/_doc/ny1z03EBxpMbNnRZgGlQ?pipeline=upper but it returns the following...

{
  "error" : {
    "root_cause" : [
      {
        "type" : "parse_exception",
        "reason" : "request body is required"
      }
    ],
    "type" : "parse_exception",
    "reason" : "request body is required"
  },
  "status" : 400
}

What am I doing wrong here? I know this is a valid _id. When I search by _id such as...

GET filebeat-7.6.2-2020.05.02-000001/_search
{
  "query": {
    "terms": {
      "_id": [
        "ny1z03EBxpMbNnRZgGlQ"
      ]
    }
  }
}

I get valid output...

...
    "hits" : [
      {
        "_index" : "filebeat-7.6.2-2020.05.02-000001",
        "_type" : "_doc",
        "_id" : "ny1z03EBxpMbNnRZgGlQ",
        "_score" : 1.0,
...

[Luca_Belluccini]

Hello @syost

The ingest pipelines are executed when indexing/updating/reindexing a document.
Not on already indexed documents.

If you want to update an already indexed document, you have to perform an update by query (if your document has_source enabled) or reindex to a different index.

May I ask why you want to make it uppercase?

[syost (Shane Yost)]

@Luca_Belluccini

I was able to get the following to work nicely...

curl -u elastic -XPUT 'localhost:9200/_ingest/pipeline/classifier?pretty' -H 'Content-Type: application/json' -d '
{                                                                                
    "description": "classifier",                                                 
    "processors": [                                                              
        {                                                                        
            "set_security_user": {                                               
                "field": "user"                                                                                         
            }                                                                    
        }                                                                        
    ]                                                                            
}                                                                                
'

curl -u elastic -XPUT 'localhost:9200/starwars/_bulk?pipeline=classifier' -H 'Content-Type: application/json' --data-binary @starwars_data.json

I'm assuming I can somehow point a beat to use a pipeline by specifying the pipeline in it's yaml configuration file too? Thanks for the clarification above.

~ S

[Luca_Belluccini]

Yes it is possible to point to use a pipeline, but if you are using any module it will be more difficult.

https://www.elastic.co/guide/en/beats/filebeat/master/configuring-ingest-node.html

It can be done also conditionally