I have a configuration described in the subject line and also here.
Logs are shipped by filebeat to a logstash which then outputs it to a rabbitmq.
All is well with this part, I can intercept messages in rabbitmq.
The content however gets lost in the second part, and I have been unable to figure out where the messages disappear.
There is a rabbimq input that processes the queue the filebeat messages are stored in, together with other kind of messages, they then pass through a reasonably simple path to end up in elasticsearch.
I can see the other messages being stored in elasticsearch from the same queue but not the ones that are originally from the beats input.
I had this in place on an older version of logstash/ES all working, this is the latest version of everything (7.3.1) where the behaviour is observed.
What can be causing this?
Thank you all in advance,