Logstash version: 6.2.4
Filebeat version: 6.2.4
We've setup an ELK stack in our company but recently we've been experiencing some issues during the morning ramp-up on our filebeats. The problem is as follows:
Filebeat can't keep up with the logs, at least that's what I can see in the monitoring, initially it's sending above 500 events per second but when this value should increase because the logs increase it starts to decline to a value between 200 & 0 events per second. I tried looking at some configuration options but the only thing I could find is when there are multiple files but in this case there's only one file (haproxy.log) so I can't increase the scan_frequency or other similar options.
This is the current filebeat configuration:
- type: log
Is there any other configuration option of filebeat that I can use to fix this issue?
Thank you for your help