We have deployed Filebeat as a daemonset on ELK operator in GKE cluster. Our Filebeat is working fine when we want to send logs directly to Elasticsearch but when it comes to send it via Logstash we are getting an issue. Though we have explicitly specified logstash in filebeat.yml file as below
output.logstash:
hosts : ["hostname:5044"]
but it is still redirecting it to elasticsearch directly.
Can anyone help, how to stop filebeat for sending the logs directly to elasticsearch.
I want filebeat to send it to elasticsearch using Logstash not directly.
Note : I have configured input as beats and output as elasticsearch in my Logstash config file as well.
Just a reference, we are using the same file as per the below link