I am encountering a strange issue. I am configuring filebeat on a windows server forwarding logs to logstash on a linux server. Network access is reachable. When configuring filebeat agents to connect to logstash servers via hostnames and I do a tcpdump on the logstash servers I dont see any network activity originating from the filebeat agents but when I use the IP's of the logstash servers on the filebeat there is network activity.
DNS works well even without host files. I confirmed with nslookup
Any idea why this is happening ?