Load ingest pipelinesedit

The ingest pipelines used to parse log lines are set up automatically the first time you run Filebeat, assuming the Elasticsearch output is enabled. If you’re sending events to Logstash, or plan to use Beats central management, you need to load the ingest pipelines manually. To do this, run the setup command with the --pipelines option specified. If you used the modules command to enable modules in the modules.d directory, also specify the --modules flag. For example, the following command loads the ingest pipelines used by all filesets enabled in the system, nginx, and mysql modules:

deb and rpm:

filebeat setup --pipelines --modules system,nginx,mysql


./filebeat setup --pipelines --modules system,nginx,mysql


./filebeat setup --pipelines --modules system,nginx,mysql


PS > .\filebeat.exe setup --pipelines --modules system,nginx,mysql

If you’re loading ingest pipelines manually because you want to send events to Logstash, also see Working with Filebeat modules.