From 20382273089a7ac62245b6db1f86203279c79223 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Mon, 26 Jan 2026 14:01:58 -0600
Subject: [PATCH] remove reference to .fleet_final_pipeline-1   - configure
 global@custom ingest pipeline to run  .fleet_final_pipeline-1 when available
 (heavynodes do not have this pipeline).   - Update global@custom pipeline to
 remove error message related to sending EA logs through logstash
 (https://github.com/elastic/kibana/issues/183959)

---
 salt/elasticsearch/defaults.yaml                    |  1 -
 salt/elasticsearch/files/ingest/global@custom       | 13 +++++++++++++
 .../so-fleet_agent_id_verification-1.json           |  2 +-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index 99403d9b8..67665a97b 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -691,7 +691,6 @@ elasticsearch:
                 match_mapping_type: string
           settings:
             index:
-              final_pipeline: .fleet_final_pipeline-1
               lifecycle:
                 name: so-import-logs
               mapping:
diff --git a/salt/elasticsearch/files/ingest/global@custom b/salt/elasticsearch/files/ingest/global@custom
index 6bf36d1a3..bafb783a4 100644
--- a/salt/elasticsearch/files/ingest/global@custom
+++ b/salt/elasticsearch/files/ingest/global@custom
@@ -177,6 +177,19 @@
                 "description": "Extract IPs from Elastic Agent events (host.ip) and adds them to related.ip"
             }
         },
+        {
+            "pipeline": {
+                "name": ".fleet_final_pipeline-1",
+                "ignore_missing_pipeline": true
+            }
+        },
+        {
+            "remove": {
+                "field": "event.agent_id_status",
+                "ignore_missing": true,
+                "if": "ctx?.event?.agent_id_status == 'auth_metadata_missing'"
+            }
+        },
         {
             "remove": {
                 "field": [
diff --git a/salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json b/salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json
index 99b3aa871..46e16bb44 100644
--- a/salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json
+++ b/salt/elasticsearch/templates/component/elastic-agent/so-fleet_agent_id_verification-1.json
@@ -2,7 +2,7 @@
   "template": {
     "settings": {
       "index": {
-        "final_pipeline": ".fleet_final_pipeline-1"
+        "final_pipeline": "global@custom"
       }
     },
     "mappings": {