Load ingest pipelines

The ingest pipelines used to parse log lines are set up automatically when you run Filebeat, assuming the Elasticsearch output is enabled.

Stack Planned The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. To turn off automatic pipeline loading during normal publishing, set:

setup.pipelines.enabled: false

Use this setting only when the required pipelines have already been loaded or are managed separately. If you’re sending events to Logstash, you need to load the ingest pipelines manually. To do this, run the setup command with the --pipelines option specified. You also need to enable the modules and filesets using one of the following methods.

First you can use the --modules option to enable the module, and the -M option to enable the fileset. For example, the following command loads the access pipeline from the nginx module.

deb and rpm:

filebeat setup --pipelines --modules nginx -M "nginx.access.enabled=true"

mac:

./filebeat setup --pipelines --modules nginx -M "nginx.access.enabled=true"

linux:

./filebeat setup --pipelines --modules nginx -M "nginx.access.enabled=true"

win:

PS > .\filebeat.exe setup --pipelines --modules nginx -M "nginx.access.enabled=true"

The second option is to use the --modules option to enable the module, and the --force-enable-module-filesets option to enable all the filesets in the module. For example, the following command loads the access pipeline from the nginx module.

deb and rpm:

filebeat setup --pipelines --modules nginx --force-enable-module-filesets

mac:

./filebeat setup --pipelines --modules nginx --force-enable-module-filesets

linux:

./filebeat setup --pipelines --modules nginx --force-enable-module-filesets

win:

PS > .\filebeat.exe setup --pipelines --modules nginx --force-enable-module-filesets

The third option is to use the --enable-all-filesets option to enable all the modules and all the filesets so all of the ingest pipelines are loaded. For example, the following command loads all the ingest pipelines.

deb and rpm:

filebeat setup --pipelines --enable-all-filesets

mac:

./filebeat setup --pipelines --enable-all-filesets

linux:

./filebeat setup --pipelines --enable-all-filesets

win:

PS > .\filebeat.exe setup --pipelines --enable-all-filesets