I tried to setup a disconnected architecture between production and monitoring, as I have non-connectivity between my production servers and my ELK stack (local network).
I planed to work as follow:
- filebeat process relevant logs and save it (output plugin) as a file
- file is synced with the ELK server
- logstash input filebeat logs
as per elastic documentation, such an approach seems possible (Configure the File output | Filebeat Reference [7.13] | Elastic)
However, I failed to configure logstatsh correctly:
using the file input plugin (tail mode) makes the process fine BUT beat logs are seen as simple logs and thus logstash puts the filebeat logs as "message" instead of considering them as it would with the beat input plugin.
Is it possible to prevent this from happening?