-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
filebeat issues using ingest pipeline #2229
Comments
Example of starting/configuring filebeat:
|
I was doing some independent testing using:
And in Filebeat was seeing:
I captured the response using Wireshark and it looks like this:
|
@andrewkroh Could you check if #2244 resolved the issue? |
#2244 fixes the issue I was seeing. And now it successfully parses the error response from Elasticsearch. 👍
|
@djschny I tried your logs with the updated Filebeat, and it looks like there is an issue with some lines not having a
|
Thanks @andrewkroh yeah, its due to the optional bytes. However it's not an issue with GROK, but rather with the I will open a separate issue for the convert processor enhancement. Thanks for fixing this guys! |
Startup elsaticsearch and register the following pipeline:
Notice it registers successfully and then try to manually use the pipeline with both simulation and indexing and notice the doc indexes successfully with no errors:
Then use filebeat to ingest data using the pipeline and notice that filebeat will throw errors parsing a bulk error response and on the elasticsearch server side there are errors with the pipeline being thrown.
Beats side of things:
Full set of example logs can be found at https://s3.amazonaws.com/elk-workshop.elasticsearch.org/source/logs.gz
Assigning to @urso but was also working with @andrewkroh as well.
The text was updated successfully, but these errors were encountered: