Filebeat - How set always retry publish events?!

Can you post the contents of /var/lib/filebeat/registry at these 3 points in time?

  1. Before you start Filebeat.

  2. After Filebeat is running and you get the 403 from Elasticsearch.

  3. After the 403 from Elasticsearch is resolved.

Thanks,

Shaunak