I have configured my ELK stack on one of our server & file beat on a remote server. The setup failed initially to listen to my changes on the remote server as i started logstash first and then the filebeat. Then i changed the sequence- started beat and then logstash. Now, i am facing an issue like - if for any reason i need to restart the filebeat on the remote server, i need to restart the logstash as well to get the data in. Is there a way to fix this?
@learn2287 In general Logstash should always be started before filebeat and elasticsearch before Logstash. Restarting filebeat and keeping Logstash running should not be an issue. Did you have any connection errors in the logs on the filebeat side?
Have you some log/debug output for us? Restarting any of the two services should be no problem.
If logstash runs before filebeat, filebeat will just connect (server-client principle). If logstash is down, filebeat will retry connecting until logstash is available again.