Elapsed filter with filebeat

[Alisa_Faingold]

Hi,

I used to work with elasticsearch, locally on my computer (using 'file' as input) and now we moved to work with filebeat and with 'S3' as input.
Until now everything worked just fine with the elapsed filter, but now the new elapsed events don't appear in Kibana.

I do get the following message:" [2019-10-22T10:41:14,485][INFO ][logstash.filters.elapsed ] Elapsed timeout: 100000 seconds", but as I said there aren't any new elapsed event or ant failure tags (like "elapsed_end_without_start","elapsed"...)

What am I missing? Do I need to create any particular configuration to make that work with filebeat?

Thank you!

[faec (Fae Charlton)]

To understand your setup -- it seems like prior to Filebeat you were using logstash, is that right? (the elapsed filter is part of logstash). Are you now sending data from Filebeat to logstash to elasticsearch, or directly to elasticsearch? Can you share your filebeat.yml so we can troubleshoot what might be happening?