If you need, there is the debug with the command filebeat -e -d "*"
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform request:append","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform request:delete","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform request:set","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform response:append","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform response:delete","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform response:set","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform pagination:append","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform pagination:delete","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/transform_registry.go","file.line":75},"message":"Register transform pagination:set","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/encoding.go","file.line":82},"message":"<nil>","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/encoding.go","file.line":83},"message":"<nil>","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/encoding.go","file.line":88},"message":"<nil>","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/encoding.go","file.line":89},"message":"<nil>","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.755+0200","log.logger":"httpjson.transforms","log.origin":{"file.name":"httpjson/encoding.go","file.line":90},"message":"<nil>","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":109},"message":"States Loaded from registrar: 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"crawler","log.origin":{"file.name":"beater/crawler.go","file.line":71},"message":"Loading Inputs: 1","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"crawler","log.origin":{"file.name":"beater/crawler.go","file.line":117},"message":"starting input, keys present on the config: [filebeat.inputs.0.enabled filebeat.inputs.0.id filebeat.inputs.0.paths.0 filebeat.inputs.0.type]","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":140},"message":"Starting Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"scanner","log.origin":{"file.name":"filestream/fswatch.go","file.line":278},"message":"recursive glob enabled","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"crawler","log.origin":{"file.name":"beater/crawler.go","file.line":148},"message":"Starting input (ID: 7770775948050077450)","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"cfgfile","log.origin":{"file.name":"cfgfile/reload.go","file.line":132},"message":"Checking module configs from: /etc/filebeat/modules.d/*.yml","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"input.filestream","log.origin":{"file.name":"compat/compat.go","file.line":111},"message":"Input filestream starting","service.name":"filebeat","id":"apache-","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/prospector.go","file.line":133},"message":"Starting prospector","service.name":"filebeat","id":"apache-","prospector":"file_prospector","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":138},"message":"Start next scan","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":205},"message":"Found 1 paths","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"cfgfile","log.origin":{"file.name":"cfgfile/reload.go","file.line":146},"message":"Number of module configs found: 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"crawler","log.origin":{"file.name":"beater/crawler.go","file.line":106},"message":"Loading and starting Inputs completed. Enabled inputs: 1","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.756+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/prospector.go","file.line":180},"message":"A new file /var/log/apache2/access.log has been found","service.name":"filebeat","id":"apache-","prospector":"file_prospector","operation":"create","source_name":"native::523373-2054","os_id":"523373-2054","new_path":"/var/log/apache2/access.log","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"input.filestream","log.origin":{"file.name":"input-logfile/harvester.go","file.line":145},"message":"Starting harvester for file","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/input.go","file.line":174},"message":"newLogFileReader with config.MaxBytes:10485760","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"detect_null_bytes","log.origin":{"file.name":"debug/debug.go","file.line":95},"message":"Starting debug reader with a buffer size of 16384 and max failures of 100","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":209},"message":"Publish event: {\n \"@timestamp\": \"2022-04-27T07:29:46.757Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.1.3\"\n },\n \"log\": {\n \"offset\": 0,\n \"file\": {\n \"path\": \"/var/log/apache2/access.log\"\n }\n },\n \"message\": \"::1 - - [26/Apr/2022:13:46:29 +0200] \\\"GET / HTTP/1.1\\\" 200 10956 \\\"-\\\" \\\"curl/7.64.0\\\"\",\n \"input\": {\n \"type\": \"filestream\"\n },\n \"host\": {\n \"name\": \"scanner\",\n \"ip\": [\n \"192.168.60.43\",\n \"fe80::250:56ff:fea5:c4b5\"\n ],\n \"mac\": [\n \"xxxxxx\"\n ],\n \"hostname\": \"scanner\",\n \"architecture\": \"x86_64\",\n \"os\": {\n \"version\": \"10 (buster)\",\n \"family\": \"debian\",\n \"name\": \"Debian GNU/Linux\",\n \"kernel\": \"4.19.0-20-amd64\",\n \"codename\": \"buster\",\n \"type\": \"linux\",\n \"platform\": \"debian\"\n },\n \"id\": \"3d9b037af48a488884677d254db8ca99\",\n \"containerized\": false\n },\n \"agent\": {\n \"name\": \"scanner\",\n \"type\": \"filebeat\",\n \"version\": \"8.1.3\",\n \"ephemeral_id\": \"1bf744f1-3bc8-485c-a770-29cc7952d428\",\n \"id\": \"c37eb5db-c6f2-492c-a8a3-63d8aa695170\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":209},"message":"Publish event: {\n \"@timestamp\": \"2022-04-27T07:29:46.757Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.1.3\"\n },\n \"host\": {\n \"containerized\": false,\n \"ip\": [\n \"192.168.60.43\",\n \"fe80::250:56ff:fea5:c4b5\"\n ],\n \"mac\": [\n \"xxxxxxxxxxxxxxxx\"\n ],\n \"hostname\": \"scanner\",\n \"architecture\": \"x86_64\",\n \"name\": \"scanner\",\n \"os\": {\n \"codename\": \"buster\",\n \"type\": \"linux\",\n \"platform\": \"debian\",\n \"version\": \"10 (buster)\",\n \"family\": \"debian\",\n \"name\": \"Debian GNU/Linux\",\n \"kernel\": \"4.19.0-20-amd64\"\n },\n \"id\": \"3d9b037af48a488884677d254db8ca99\"\n },\n \"log\": {\n \"offset\": 82,\n \"file\": {\n \"path\": \"/var/log/apache2/access.log\"\n }\n },\n \"message\": \"::1 - - [26/Apr/2022:13:47:58 +0200] \\\"GET / HTTP/1.1\\\" 200 10956 \\\"-\\\" \\\"curl/7.64.0\\\"\",\n \"input\": {\n \"type\": \"filestream\"\n },\n \"agent\": {\n \"type\": \"filebeat\",\n \"version\": \"8.1.3\",\n \"ephemeral_id\": \"1bf744f1-3bc8-485c-a770-29cc7952d428\",\n \"id\": \"c37eb5db-c6f2-492c-a8a3-63d8aa695170\",\n \"name\": \"scanner\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":209},"message":"Publish event: {\n \"@timestamp\": \"2022-04-27T07:29:46.757Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.1.3\"\n },\n \"log\": {\n \"offset\": 164,\n \"file\": {\n \"path\": \"/var/log/apache2/access.log\"\n }\n },\n \"message\": \"::1 - - [26/Apr/2022:13:50:26 +0200] \\\"GET / HTTP/1.1\\\" 200 10956 \\\"-\\\" \\\"curl/7.64.0\\\"\",\n \"input\": {\n \"type\": \"filestream\"\n },\n \"host\": {\n \"ip\": [\n \"192.168.60.43\",\n \"fe80::250:56ff:fea5:c4b5\"\n ],\n \"mac\": [\n \"xxxxxxxxxxxxxxxx\"\n ],\n \"hostname\": \"scanner\",\n \"architecture\": \"x86_64\",\n \"name\": \"scanner\",\n \"os\": {\n \"family\": \"debian\",\n \"name\": \"Debian GNU/Linux\",\n \"kernel\": \"4.19.0-20-amd64\",\n \"codename\": \"buster\",\n \"type\": \"linux\",\n \"platform\": \"debian\",\n \"version\": \"10 (buster)\"\n },\n \"id\": \"3d9b037af48a488884677d254db8ca99\",\n \"containerized\": false\n },\n \"agent\": {\n \"id\": \"c37eb5db-c6f2-492c-a8a3-63d8aa695170\",\n \"name\": \"scanner\",\n \"type\": \"filebeat\",\n \"version\": \"8.1.3\",\n \"ephemeral_id\": \"1bf744f1-3bc8-485c-a770-29cc7952d428\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.757+0200","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":209},"message":"Publish event: {\n \"@timestamp\": \"2022-04-27T07:29:46.757Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.1.3\"\n },\n \"message\": \"::1 - - [26/Apr/2022:13:51:18 +0200] \\\"GET / HTTP/1.1\\\" 200 10956 \\\"-\\\" \\\"curl/7.64.0\\\"\",\n \"input\": {\n \"type\": \"filestream\"\n },\n \"host\": {\n \"mac\": [\n \"xxxxxxxxxxxxxxxxxx\"\n ],\n \"hostname\": \"scanner\",\n \"name\": \"scanner\",\n \"architecture\": \"x86_64\",\n \"os\": {\n \"name\": \"Debian GNU/Linux\",\n \"kernel\": \"4.19.0-20-amd64\",\n \"codename\": \"buster\",\n \"type\": \"linux\",\n \"platform\": \"debian\",\n \"version\": \"10 (buster)\",\n \"family\": \"debian\"\n },\n \"id\": \"3d9b037af48a488884677d254db8ca99\",\n \"containerized\": false,\n \"ip\": [\n \"192.168.60.43\",\n \"fe80::250:56ff:fea5:c4b5\"\n ]\n },\n \"agent\": {\n \"ephemeral_id\": \"1bf744f1-3bc8-485c-a770-29cc7952d428\",\n \"id\": \"c37eb5db-c6f2-492c-a8a3-63d8aa695170\",\n \"name\": \"scanner\",\n \"type\": \"filebeat\",\n \"version\": \"8.1.3\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"log\": {\n \"file\": {\n \"path\": \"/var/log/apache2/access.log\"\n },\n \"offset\": 246\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":209},"message":"Publish event: {\n \"@timestamp\": \"2022-04-27T07:29:46.757Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.1.3\"\n },\n \"host\": {\n \"name\": \"scanner\",\n \"architecture\": \"x86_64\",\n \"os\": {\n \"codename\": \"buster\",\n \"type\": \"linux\",\n \"platform\": \"debian\",\n \"version\": \"10 (buster)\",\n \"family\": \"debian\",\n \"name\": \"Debian GNU/Linux\",\n \"kernel\": \"4.19.0-20-amd64\"\n },\n \"id\": \"3d9b037af48a488884677d254db8ca99\",\n \"containerized\": false,\n \"ip\": [\n \"192.168.60.43\",\n \"fe80::250:56ff:fea5:c4b5\"\n ],\n \"mac\": [\n \"xxxxxxxxxxxxxxx\"\n ],\n \"hostname\": \"scanner\"\n },\n \"agent\": {\n \"type\": \"filebeat\",\n \"version\": \"8.1.3\",\n \"ephemeral_id\": \"1bf744f1-3bc8-485c-a770-29cc7952d428\",\n \"id\": \"c37eb5db-c6f2-492c-a8a3-63d8aa695170\",\n \"name\": \"scanner\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"log\": {\n \"offset\": 328,\n \"file\": {\n \"path\": \"/var/log/apache2/access.log\"\n }\n },\n \"message\": \"::1 - - [26/Apr/2022:14:27:23 +0200] \\\"GET / HTTP/1.1\\\" 200 10956 \\\"-\\\" \\\"curl/7.64.0\\\"\",\n \"input\": {\n \"type\": \"filestream\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"processors","log.origin":{"file.name":"processing/processors.go","file.line":209},"message":"Publish event: {\n \"@timestamp\": \"2022-04-27T07:29:46.758Z\",\n \"@metadata\": {\n \"beat\": \"filebeat\",\n \"type\": \"_doc\",\n \"version\": \"8.1.3\"\n },\n \"log\": {\n \"offset\": 410,\n \"file\": {\n \"path\": \"/var/log/apache2/access.log\"\n }\n },\n \"message\": \"::1 - - [26/Apr/2022:16:17:35 +0200] \\\"GET / HTTP/1.1\\\" 200 10956 \\\"-\\\" \\\"curl/7.64.0\\\"\",\n \"input\": {\n \"type\": \"filestream\"\n },\n \"ecs\": {\n \"version\": \"8.0.0\"\n },\n \"host\": {\n \"hostname\": \"scanner\",\n \"name\": \"scanner\",\n \"architecture\": \"x86_64\",\n \"os\": {\n \"platform\": \"debian\",\n \"version\": \"10 (buster)\",\n \"family\": \"debian\",\n \"name\": \"Debian GNU/Linux\",\n \"kernel\": \"4.19.0-20-amd64\",\n \"codename\": \"buster\",\n \"type\": \"linux\"\n },\n \"id\": \"3d9b037af48a488884677d254db8ca99\",\n \"containerized\": false,\n \"ip\": [\n \"192.168.60.43\",\n \"fe80::250:56ff:fea5:c4b5\"\n ],\n \"mac\": [\n \"xxxxxxxxxxxxx\"\n ]\n },\n \"agent\": {\n \"name\": \"scanner\",\n \"type\": \"filebeat\",\n \"version\": \"8.1.3\",\n \"ephemeral_id\": \"1bf744f1-3bc8-485c-a770-29cc7952d428\",\n \"id\": \"c37eb5db-c6f2-492c-a8a3-63d8aa695170\"\n }\n}","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/filestream.go","file.line":131},"message":"End of file reached: /var/log/apache2/access.log; Backoff now.","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.756+0200","log.origin":{"file.name":"cfgfile/reload.go","file.line":164},"message":"Config reloader started","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"cfgfile","log.origin":{"file.name":"cfgfile/reload.go","file.line":194},"message":"Scan for new config files","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"cfgfile","log.origin":{"file.name":"cfgfile/reload.go","file.line":213},"message":"Number of module configs found: 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"reload","log.origin":{"file.name":"cfgfile/list.go","file.line":63},"message":"Starting reload procedure, current runners: 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:46.758+0200","log.logger":"reload","log.origin":{"file.name":"cfgfile/list.go","file.line":81},"message":"Start list: 0, Stop list: 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:46.758+0200","log.origin":{"file.name":"cfgfile/reload.go","file.line":224},"message":"Loading of config files completed.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:47.759+0200","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":139},"message":"Connecting to kafka(10.60.101.11:9092)","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:47.759+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":100},"message":"connect: [10.60.101.11:9092]","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:47.759+0200","log.logger":"publisher_pipeline_output","log.origin":{"file.name":"pipeline/client_worker.go","file.line":147},"message":"Connection to kafka(10.60.101.11:9092) established","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:48.759+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/filestream.go","file.line":131},"message":"End of file reached: /var/log/apache2/access.log; Backoff now.","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:52.759+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/filestream.go","file.line":131},"message":"End of file reached: /var/log/apache2/access.log; Backoff now.","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:29:56.757+0200","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":138},"message":"Start next scan","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:56.757+0200","log.logger":"file_watcher","log.origin":{"file.name":"filestream/fswatch.go","file.line":205},"message":"Found 1 paths","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.645+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":372},"message":"finished kafka batch","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.645+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":386},"message":"Kafka publish failed with: dial tcp: lookup interlog on 192.168.60.4:53: server misbehaving","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.645+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":177},"message":"got event.Meta[\"partition\"] = 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.645+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":177},"message":"got event.Meta[\"partition\"] = 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.645+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":177},"message":"got event.Meta[\"partition\"] = 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.646+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":177},"message":"got event.Meta[\"partition\"] = 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.646+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":177},"message":"got event.Meta[\"partition\"] = 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:29:58.646+0200","log.logger":"kafka","log.origin":{"file.name":"kafka/client.go","file.line":177},"message":"got event.Meta[\"partition\"] = 0","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:00.760+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/filestream.go","file.line":131},"message":"End of file reached: /var/log/apache2/access.log; Backoff now.","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
^C{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.050+0200","log.logger":"service","log.origin":{"file.name":"service/service.go","file.line":54},"message":"Received sigterm/sigint, stopping","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.050+0200","log.origin":{"file.name":"beater/filebeat.go","file.line":427},"message":"Stopping filebeat","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.051+0200","log.origin":{"file.name":"beater/crawler.go","file.line":155},"message":"Stopping Crawler","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.052+0200","log.origin":{"file.name":"beater/crawler.go","file.line":165},"message":"Stopping 1 inputs","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.052+0200","log.origin":{"file.name":"cfgfile/reload.go","file.line":227},"message":"Dynamic config reloader stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.052+0200","log.logger":"crawler","log.origin":{"file.name":"beater/crawler.go","file.line":170},"message":"Stopping input: 7770775948050077450","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"input.filestream","log.origin":{"file.name":"compat/compat.go","file.line":132},"message":"Input 'filestream' stopped","service.name":"filebeat","id":"apache-","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/input.go","file.line":143},"message":"Closing reader of filestream","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":158},"message":"client: closing acker","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":163},"message":"client: done closing acker","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":165},"message":"client: unlink from queue","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":187},"message":"client: cancelled 0 events","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":167},"message":"client: done unlink","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":170},"message":"client: closing processors","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"publisher","log.origin":{"file.name":"pipeline/client.go","file.line":175},"message":"client: done closing processors","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.054+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/input.go","file.line":320},"message":"Reader was closed. Closing.","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","path":"/var/log/apache2/access.log","state-id":"native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"input.filestream","log.origin":{"file.name":"input-logfile/harvester.go","file.line":219},"message":"Stopped harvester for file","service.name":"filebeat","id":"apache-","source_file":"filestream::apache-::native::523373-2054","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"input.filestream","log.origin":{"file.name":"filestream/prospector.go","file.line":165},"message":"Prospector has stopped","service.name":"filebeat","id":"apache-","prospector":"file_prospector","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"input.filestream","log.origin":{"file.name":"compat/compat.go","file.line":124},"message":"Input 'filestream' stopped","service.name":"filebeat","id":"apache-","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.054+0200","log.origin":{"file.name":"beater/crawler.go","file.line":185},"message":"Crawler stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":132},"message":"Stopping Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":166},"message":"Ending Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"debug","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":167},"message":"Stopping Registrar","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.055+0200","log.logger":"registrar","log.origin":{"file.name":"registrar/registrar.go","file.line":137},"message":"Registrar stopped","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.063+0200","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":192},"message":"Total metrics","service.name":"filebeat","monitoring":{"metrics":{"beat":{"cgroup":{"memory":{"id":"session-c2.scope","mem":{"limit":{"bytes":9223372036854771712},"usage":{"bytes":631730176}}}},"cpu":{"system":{"ticks":40,"time":{"ms":49}},"total":{"ticks":200,"time":{"ms":214},"value":200},"user":{"ticks":160,"time":{"ms":165}}},"handles":{"limit":{"hard":1048576,"soft":1024},"open":10},"info":{"ephemeral_id":"1bf744f1-3bc8-485c-a770-29cc7952d428","uptime":{"ms":16373},"version":"8.1.3"},"memstats":{"gc_next":22809376,"memory_alloc":17420464,"memory_sys":33113096,"memory_total":51494840,"rss":128786432},"runtime":{"goroutines":24}},"filebeat":{"events":{"active":6,"added":6,"done":0},"harvester":{"closed":0,"open_files":0,"running":0,"skipped":0,"started":0},"input":{"log":{"files":{"renamed":0,"truncated":0}},"netflow":{"flows":0,"packets":{"dropped":0,"received":0}}}},"libbeat":{"config":{"module":{"running":0,"starts":0,"stops":0},"reloads":1,"scans":1},"output":{"events":{"acked":0,"active":6,"batches":2,"dropped":0,"duplicates":0,"failed":6,"toomany":0,"total":12},"read":{"bytes":0,"errors":0},"type":"kafka","write":{"bytes":0,"errors":0}},"outputs":{"kafka":{"bytes_read":565,"bytes_write":160}},"pipeline":{"clients":0,"events":{"active":6,"dropped":0,"failed":0,"filtered":0,"published":6,"retry":12,"total":6},"queue":{"acked":0,"max_events":4096}}},"registrar":{"states":{"cleanup":0,"current":0,"update":0},"writes":{"fail":0,"success":0,"total":0}},"system":{"cpu":{"cores":3},"load":{"1":0.02,"15":0,"5":0.02,"norm":{"1":0.0067,"15":0,"5":0.0067}}}},"ecs.version":"1.6.0"}}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.064+0200","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":193},"message":"Uptime: 16.381242707s","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.064+0200","log.logger":"monitoring","log.origin":{"file.name":"log/log.go","file.line":160},"message":"Stopping metrics logging.","service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info","@timestamp":"2022-04-27T09:30:03.064+0200","log.origin":{"file.name":"instance/beat.go","file.line":494},"message":"filebeat stopped.","service.name":"filebeat","ecs.version":"1.6.0"}