So you are saying logstash is not sending ack? I tried debugging the log pipeline and I see the logs in kibana.
That's exactly why I connected the filebeat logs itself: I see that error in kibana so logs are going straight forward to the destination, not more than 10s after they are created.
Furthermore it never happens in peak time, I usually see it during night when the pipeline is off load.
how are those ack messages sent from logstash back to filebeat? does it use a special port or something else I can check?