From 327199be83a45a2b8a6dae1374d8c39ab3b6cdb4 Mon Sep 17 00:00:00 2001 From: Luca Belluccini Date: Fri, 21 Feb 2025 20:55:36 +0100 Subject: [PATCH] [DOCS] Warn LS pipeline should not modify fields coming from EA (#1667) * [DOCS] Warn LS pipeline should not modify fields coming from EA Warn LS pipeline should not modify fields coming from EA Modifying data coming from EA can prevent the ingest pipelines on Elasticsearch side associated to the integrations in use in EA to work correctly. * Update docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc --------- Co-authored-by: David Kilfoyle <41695641+kilfoyle@users.noreply.github.com> (cherry picked from commit e37bb567a846c779236851b040c1d388094a6373) --- .../configuration/outputs/output-logstash.asciidoc | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc b/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc index 71dc07094..6514dcd99 100644 --- a/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc +++ b/docs/en/ingest-management/elastic-agent/configuration/outputs/output-logstash.asciidoc @@ -32,6 +32,11 @@ To receive the events in {ls}, you also need to create a {ls} configuration pipe The {ls} configuration pipeline listens for incoming {agent} connections, processes received events, and then sends the events to {es}. +Please be aware that the structure of the documents sent from {agent} to {ls} must not be modified by the pipeline. +We recommend that the pipeline doesn’t edit or remove the fields and their contents. +Editing the structure of the documents coming from {agent} can prevent the {es} ingest pipelines associated to the integrations in use to work correctly. +We cannot guarantee that the {es} ingest pipelines associated to the integrations using {agent} can work with missing or modified fields. + The following {ls} pipeline definition example configures a pipeline that listens on port `5044` for incoming {agent} connections and routes received events to {es}.