problem is solved it was beats sending messages over to elastic directly .
Ok seems like I found the issue and it's a problem with filebeats on master elk stack server.
When I installed filebeats on another host the messages went ok.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.