Dear All,
I am running a central ELK stack 8.6.2 with logstash to collect data from some server around. More than 2 years ago I compiled filebeat by myself as it was not available on ARM architecture. With a minimal configuration I read data from a file and send it to central logstash and then to elasticsearch DB where I can see data via kibana.
Now filebeat is available as packaged on ARM architecture and I installed this packages. With a similar minimal configuration I started filebeat. With tcpdump I see that data is transferred on the configured port between these two servers, but I don't see the data in ELK.
Now my question how can I debug where my data get lost ? The logs don't give me an answer.
Kind regards
Hans
--