Load ingest pipelines

The ingest pipelines used to parse log lines are set up automatically the first time you run Filebeat, assuming the Elasticsearch output is enabled. If you’re sending events to Logstash you need to load the ingest pipelines manually. To do this, run the setup command with the --pipelines option specified. If you used the modules command to enable modules in the modules.d directory, also specify the --modules flag. For example, the following command loads the ingest pipelines used by all filesets enabled in the system, nginx, and mysql modules:

deb and rpm:

filebeat setup --pipelines --modules system,nginx,mysql

mac:

./filebeat setup --pipelines --modules system,nginx,mysql

linux:

./filebeat setup --pipelines --modules system,nginx,mysql

win:

PS > .\filebeat.exe setup --pipelines --modules system,nginx,mysql