diff --git a/reference/ingestion-tools/fleet/logstash-output.md b/reference/ingestion-tools/fleet/logstash-output.md index 8340b30bed..43c09cc01c 100644 --- a/reference/ingestion-tools/fleet/logstash-output.md +++ b/reference/ingestion-tools/fleet/logstash-output.md @@ -25,6 +25,8 @@ outputs: To receive the events in {{ls}}, you also need to create a {{ls}} configuration pipeline. The {{ls}} configuration pipeline listens for incoming {{agent}} connections, processes received events, and then sends the events to {{es}}. +Please be aware that the structure of the documents sent from {{agent}} to {{ls}} must not be modified by the pipeline. We recommend that the pipeline doesn’t edit or remove the fields and their contents. Editing the structure of the documents coming from {{agent}} can prevent the {{es}} ingest pipelines associated to the integrations in use to work correctly. We cannot guarantee that the {{es}} ingest pipelines associated to the integrations using {agent} can work with missing or modified fields. + The following {{ls}} pipeline definition example configures a pipeline that listens on port `5044` for incoming {{agent}} connections and routes received events to {{es}}. ```yaml