The ingest pipelines used to parse log lines are set up automatically the first time you run Filebeat, assuming the Elasticsearch output is enabled. If you’re sending events to Logstash you need to load the ingest pipelines manually. To do this, run the setup command with the --pipelines option specified. You also need to enable the modules and filesets, this can be accomplished one of two ways.

First you can use the --modules option to enable the module, and the -M option to enable the fileset. For example, the following command loads the access pipeline from the nginx module.

deb and rpm:

filebeat setup --pipelines --modules nginx -M "nginx.access.enabled=true"

mac:

./filebeat setup --pipelines --modules nginx -M "nginx.access.enabled=true"

linux:

./filebeat setup --pipelines --modules nginx -M "nginx.access.enabled=true"

win:

PS > .\filebeat.exe setup --pipelines --modules nginx -M "nginx.access.enabled=true"

The second option is to use the --enable-all-filesets option to enable all the modules and all the filesets so all of the ingest pipelines are loaded. For example, the following command loads all the ingest pipelines.

deb and rpm:

filebeat setup --pipelines --enable-all-filesets

mac:

./filebeat setup --pipelines --enable-all-filesets

linux:

./filebeat setup --pipelines --enable-all-filesets

win:

PS > .\filebeat.exe setup --pipelines --enable-all-filesets