I have setup filebeat on 3 servers. The filebeat is able to send logs to logstash server without issues from 2 servers.
From 3rd server, i can see file beat is running without any issues and logstash also running on logstash server.
Here is what i can see in the filebeat log
2018-11-02T14:17:29.575-0400 DEBUG [harvester] log/log.go:85 End of file reached: /opt/sp/src/log/app.2018-10-05.19.log; Backoff now.
2018-11-02T14:17:58.938-0400 DEBUG [multiline] reader/multiline.go:155 Multiline event flushed because timeout reached.
2018-11-02T14:17:59.302-0400 DEBUG [filter] pipeline/processor.go:157 fail to apply processor client{drop_fields=prospector, @timestamp, beat, offset, host, source, @metadata, beat.name, beat.hostname, beat.timezone, beat.version, tags, @version, input}: key not found, key not found, key not found, key not found, key not found, key not found, key not found, key not found, key not found, key not found
2018-11-02T14:29:57.866-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:29:58.736-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.2018-10-06.0.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:29:58.737-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.2018-10-06.0.log
2018-11-02T14:29:58.737-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.2018-10-06.0.log
2018-11-02T14:29:58.741-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.2018-10-06.0.log, offset: 0
2018-11-02T14:29:59.141-0400 DEBUG [harvester] log/harvester.go:505 harvester cleanup finished for file: /opt/sp/src/log/app.2018-10-06.0.log
2018-11-02T14:30:03.813-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:30:04.362-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.2018-10-08.0.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:30:04.370-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.2018-10-08.0.log
2018-11-02T14:30:04.370-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.2018-10-08.0.log
2018-11-02T14:30:04.370-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.2018-10-08.0.log, offset: 0
2018-11-02T14:30:04.540-0400 DEBUG [harvester] log/harvester.go:505 harvester cleanup finished for file: /opt/sp/src/log/app.2018-10-08.0.log
2018-11-02T14:30:06.262-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:30:06.277-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:30:06.285-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.2018-10-15.0.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:30:06.286-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.2018-10-15.0.log
2018-11-02T14:30:06.286-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.2018-10-15.0.log
2018-11-02T14:30:06.286-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.2018-10-15.0.log, offset: 0
2018-11-02T14:30:06.308-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:30:06.308-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.2018-10-10.0.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:30:06.308-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.2018-10-10.0.log
2018-11-02T14:30:06.308-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.2018-10-10.0.log
2018-11-02T14:30:06.308-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.2018-10-10.0.log, offset: 0
2018-11-02T14:30:06.309-0400 DEBUG [harvester] log/harvester.go:505 harvester cleanup finished for file: /opt/sp/src/log/app.2018-10-10.0.log
2018-11-02T14:30:06.392-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:30:06.397-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:30:06.398-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.log
2018-11-02T14:30:06.398-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.log
2018-11-02T14:30:06.398-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.log, offset: 0
2018-11-02T14:30:06.425-0400 DEBUG [multiline] reader/multiline.go:126 Multiline event flushed because timeout reached.
2018-11-02T14:30:06.425-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.2018-10-11.0.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:30:06.425-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.2018-10-11.0.log
2018-11-02T14:30:06.425-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.2018-10-11.0.log
2018-11-02T14:30:06.425-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.2018-10-11.0.log, offset: 0
2018-11-02T14:30:06.561-0400 INFO log/harvester.go:253 File is inactive: /opt/sp/src/log/app.2018-10-13.0.log. Closing because close_inactive of 5m0s reached.
2018-11-02T14:30:06.561-0400 DEBUG [harvester] log/harvester.go:484 Stopping harvester for file: /opt/sp/src/log/app.2018-10-13.0.log
2018-11-02T14:30:06.561-0400 DEBUG [harvester] log/harvester.go:494 Closing file: /opt/sp/src/log/app.2018-10-13.0.log
2018-11-02T14:30:06.561-0400 DEBUG [harvester] log/harvester.go:364 Update state: /opt/sp/src/log/app.2018-10-13.0.log, offset: 0
2018-11-02T14:30:06.562-0400 DEBUG [harvester] log/harvester.go:505 harvester cleanup finished for file: /opt/sp/src/log/app.2018-10-15.0.log
2018-11-02T14:30:06.776-0400 DEBUG [harvester] log/harvester.go:505 harvester cleanup finished for file: /opt/sp/src/log/app.2018-10-13.0.log
Please advice what might be the wrong in conf.