I have configured FileBeat to ship a log file to Elasticsearch directly.
After all harvesters have already automatically stopped with a close_inactive message, I ran a count check in the filebeat indices in ES.
While the number of lines in the log file is 689398 according to wc -l, the number of documents in the index is only 6849.
Does this mean that not all logs have been shipped? What should I do?
At the same time, it might be helpful if you give us some information like the configuration used, version of Filebeat and the size and format of the logs file.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.