From fea4f3f9734bce630a409640f4d465c467c6078e Mon Sep 17 00:00:00 2001
From: weslambert <wlambertts@gmail.com>
Date: Mon, 19 Jul 2021 12:57:42 -0400
Subject: [PATCH] Check if Filebeat modules are being used for incoming Beats

---
 salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja b/salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja
index 2ad403ab9..c6537d2f5 100644
--- a/salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja
+++ b/salt/logstash/pipelines/config/so/9500_output_beats.conf.jinja
@@ -6,7 +6,7 @@
 {%- set ES_USER = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:user', '') %}
 {%- set ES_PASS = salt['pillar.get']('elasticsearch:auth:users:so_elastic_user:pass', '') %}
 output {
-  if "beat-ext" in [tags] and "import" not in [tags] {
+  if "beat-ext" in [tags] and "import" not in [tags] and "filebeat" not in [metadata][pipeline] {
     elasticsearch {
       pipeline => "beats.common" 
       hosts => "{{ ES }}"