From f8ac48eb8fb66a28c8aee827ca3634b1a37a094b Mon Sep 17 00:00:00 2001 From: David Kilfoyle Date: Tue, 4 Mar 2025 11:41:19 -0500 Subject: [PATCH] Add details/warning about Logstash pipeline with integrations --- reference/ingestion-tools/fleet/logstash-output.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/reference/ingestion-tools/fleet/logstash-output.md b/reference/ingestion-tools/fleet/logstash-output.md index 8340b30bed..43c09cc01c 100644 --- a/reference/ingestion-tools/fleet/logstash-output.md +++ b/reference/ingestion-tools/fleet/logstash-output.md @@ -25,6 +25,8 @@ outputs: To receive the events in {{ls}}, you also need to create a {{ls}} configuration pipeline. The {{ls}} configuration pipeline listens for incoming {{agent}} connections, processes received events, and then sends the events to {{es}}. +Please be aware that the structure of the documents sent from {{agent}} to {{ls}} must not be modified by the pipeline. We recommend that the pipeline doesn’t edit or remove the fields and their contents. Editing the structure of the documents coming from {{agent}} can prevent the {{es}} ingest pipelines associated to the integrations in use to work correctly. We cannot guarantee that the {{es}} ingest pipelines associated to the integrations using {agent} can work with missing or modified fields. + The following {{ls}} pipeline definition example configures a pipeline that listens on port `5044` for incoming {{agent}} connections and routes received events to {{es}}. ```yaml