I have an ELK stack running on Ubuntu 20.04 server which is currently ingesting Filebeat IIS logs from a Windows machine.
When I run the filebeat setup command from the Linux server to install the dashboards, index and so on, they install without errors, however when I click on the IIS dashboard or any visualisation nothing is showing up.
Once I run the filebeat command from the Windows machine which is sending the logs everything is fine.
Now, I have enabled netflow module on the Linux server hosting the ELK and the netflow data is coming in. I am afraid to run the filebeat setup from the server to install the dashboards because I take it the working IIS dashboards will get wiped and will stop working?
I don't see any clear instructions on what to do in this case