Hi,
I want to retrieve the beats that are not running / not communicating / not configuered well.
Basically get all the beats that are not Running in the config status in central management page.
I tried to do this by quering the .management-beats index.
The main problem is that I don't understand this index behavior.
The data is always changing, updated, deleted, not a regular report to elastic kind of behavior.
So my question is this:
- What is the behavior of .management-beats index?
- How can I query which beats are not running (as in the central-management panel)?
Thanks